f08ea3be4cf805af07cc7cef53967734d166e6a8f16ada392d92e29c85e47037

Analysis

user interaction
yes
max time kernel
300s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kesie Optimal New (1).zip
Size 1.5MB
Sample260428-vx2y2act6w
SHA256 f08ea3be4cf805af07cc7cef53967734d166e6a8f16ada392d92e29c85e47037
MD5 2022dfa58e60d88890e8c8add6f01510
SHA1 d283ff5cd51635541f0a2d815a21ad3f2ea56680
SHA512 3e2bb5489db725019b4a8603150a925e43a1acbcdf1433479213bfc178f7a2e0b7f7dc39c93ddfce035c3fc2d5478bd14b273a278bff5e555c38834c0cbe3573
SSDEEP 24576:pVRQyQXoBrT+grHTBJT+Hs8sZY+8vo1a13gvXfOnWHZ7x75Lnl/kVwRn2gdbsDJ1:pBQXoBrT9HraHs5Zn2ma+/fOnWxx75LK
TLSH
T1B1657C29C437AE80DC8F9435803FA2C7D69D43155D1C89FF6A6CC3047FEE9812666EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
384	msedge.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_384_984466513\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1614212729\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_76918892\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_286538765\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_286538765\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_76918892\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_76918892\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_286538765\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_645065896\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1614212729\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\is\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_76918892\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1763040527\128.png	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3496	msedge.exe
1148	chrome.exe
5708	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d815d71034d7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081ca301234d7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d41b011234d7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9f1371234d7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a383871134d7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe9dc41234d7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\NodeSlot = "20"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0a00000001000000090000000700000008000000060000000500000004000000030000000200000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 4e003100000000009c5c5c8b10006974656d00003a0009000400efbe9c5c5c8b9c5c5c8b2e0000008d99020000000300000000000000000000000000000026ac24016900740065006d00000014000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
384	msedge.exe
384	msedge.exe
1268	chrome.exe
1268	chrome.exe
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
592	chrome.exe
4948	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
3720	msedge.exe
3720	msedge.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
592	chrome.exe
592	chrome.exe
592	chrome.exe
4948	chrome.exe
6008	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 6044	2384	chrome.exe	80
PID 2384 wrote to memory of 1148	2384	chrome.exe	81
PID 2384 wrote to memory of 5404	2384	chrome.exe	82
PID 2384 wrote to memory of 5404	2384	chrome.exe	82
PID 2384 wrote to memory of 3676	2384	chrome.exe	83
PID 2384 wrote to memory of 3676	2384	chrome.exe	83
PID 2384 wrote to memory of 5544	2384	chrome.exe	85
PID 2384 wrote to memory of 3172	2384	chrome.exe	86
PID 2384 wrote to memory of 5544	2384	chrome.exe	85
PID 2384 wrote to memory of 3172	2384	chrome.exe	86
PID 2384 wrote to memory of 5904	2384	chrome.exe	87
PID 2384 wrote to memory of 5904	2384	chrome.exe	87
PID 2384 wrote to memory of 2012	2384	chrome.exe	89
PID 2384 wrote to memory of 2012	2384	chrome.exe	89
PID 2384 wrote to memory of 6104	2384	chrome.exe	91
PID 2384 wrote to memory of 5656	2384	chrome.exe	95
PID 2384 wrote to memory of 4404	2384	chrome.exe	96
PID 2384 wrote to memory of 4908	2384	chrome.exe	97
PID 3720 wrote to memory of 5060	3720	msedge.exe	99
PID 3720 wrote to memory of 4692	3720	msedge.exe	100
PID 3720 wrote to memory of 5708	3720	msedge.exe	101
PID 3720 wrote to memory of 4692	3720	msedge.exe	100
PID 3720 wrote to memory of 4692	3720	msedge.exe	100
PID 3720 wrote to memory of 2368	3720	msedge.exe	102
PID 3720 wrote to memory of 2368	3720	msedge.exe	102
PID 3720 wrote to memory of 2828	3720	msedge.exe	104
PID 3720 wrote to memory of 3344	3720	msedge.exe	105
PID 3720 wrote to memory of 2828	3720	msedge.exe	104
PID 3720 wrote to memory of 2828	3720	msedge.exe	104
PID 3720 wrote to memory of 3344	3720	msedge.exe	105
PID 3720 wrote to memory of 3344	3720	msedge.exe	105
PID 3720 wrote to memory of 464	3720	msedge.exe	106
PID 3720 wrote to memory of 464	3720	msedge.exe	106
PID 3720 wrote to memory of 464	3720	msedge.exe	106
PID 3720 wrote to memory of 384	3720	msedge.exe	107
PID 384 wrote to memory of 5716	384	msedge.exe	108
PID 384 wrote to memory of 3496	384	msedge.exe	109
PID 384 wrote to memory of 5324	384	msedge.exe	110
PID 384 wrote to memory of 5324	384	msedge.exe	110
PID 384 wrote to memory of 5324	384	msedge.exe	110
PID 384 wrote to memory of 5836	384	msedge.exe	111
PID 384 wrote to memory of 5836	384	msedge.exe	111
PID 384 wrote to memory of 2568	384	msedge.exe	114
PID 384 wrote to memory of 4284	384	msedge.exe	118
PID 384 wrote to memory of 5144	384	msedge.exe	119
PID 384 wrote to memory of 5212	384	msedge.exe	120
PID 384 wrote to memory of 4620	384	msedge.exe	121
PID 384 wrote to memory of 4620	384	msedge.exe	121
PID 384 wrote to memory of 1852	384	msedge.exe	122
PID 384 wrote to memory of 1852	384	msedge.exe	122
PID 1396 wrote to memory of 4128	1396	SearchIndexer.exe	125
PID 1396 wrote to memory of 4152	1396	SearchIndexer.exe	126
PID 1396 wrote to memory of 3908	1396	SearchIndexer.exe	127
PID 384 wrote to memory of 4564	384	msedge.exe	129
PID 384 wrote to memory of 4564	384	msedge.exe	129
PID 2384 wrote to memory of 1268	2384	chrome.exe	130
PID 384 wrote to memory of 4748	384	msedge.exe	131
PID 384 wrote to memory of 4748	384	msedge.exe	131
PID 384 wrote to memory of 4924	384	msedge.exe	134
PID 384 wrote to memory of 244	384	msedge.exe	135
PID 384 wrote to memory of 244	384	msedge.exe	135
PID 2384 wrote to memory of 2364	2384	chrome.exe	136
PID 2384 wrote to memory of 2364	2384	chrome.exe	136
PID 2384 wrote to memory of 4964	2384	chrome.exe	137

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Kesie Optimal New (1).zip"
1⤵
PID:5088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbe11cc728,0x7ffbe11cc734,0x7ffbe11cc740
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,6659090871172716517,15317512167552456771,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,9813125893801056941,16239637142265390941,262144 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,13598516263974549119,15908278307356912017,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,6335711101403174111,4314325996189228126,2097152 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,10805412930105125782,141395166127028126,2097152 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,9775066552935406315,9817213896239332941,2097152 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,3517121611169661659,9080036271026798869,2097152 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,5293533569854903288,17591832062772001707,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,1237099931922668718,9397743267513195104,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,10965342737335602949,17171825502606971996,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,5481124108942533222,8052583143241889878,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5764,i,111280630677116724,637697180318966953,262144 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5668,i,11974156013469384902,17438351937460735152,2097152 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3632,i,4029121823812265780,9691753937905001696,2097152 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3856,i,10712342513280819162,12716895055282794374,2097152 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3836,i,4220680281834816546,3149941141899450437,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,11845235271056898699,7526245626115850601,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,14894233513342939645,17290137421060575650,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,5103036554256731838,16641279291588767150,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,6822065614199335266,3042287063058711903,524288 --field-trial-handle=2052,i,11100207573166487663,11704743663836128387,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4572 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://kesie/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffbcc6ac188,0x7ffbcc6ac194,0x7ffbcc6ac1a0
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17664698224690277443,9801943745236497706,262144 --field-trial-handle=2180,i,5415267201011144303,15163722168019428470,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,1939674083526908188,5179259711187572171,524288 --field-trial-handle=2180,i,5415267201011144303,15163722168019428470,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,14626263697073302923,2156086194990712486,524288 --field-trial-handle=2180,i,5415267201011144303,15163722168019428470,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,15598839602728274852,8897974857266682655,2097152 --field-trial-handle=2180,i,5415267201011144303,15163722168019428470,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14979764797453143474,17363007917771615140,2097152 --field-trial-handle=2180,i,5415267201011144303,15163722168019428470,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,13481328349905926182,17839089666543362639,2097152 --field-trial-handle=2180,i,5415267201011144303,15163722168019428470,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffbcc6ac188,0x7ffbcc6ac194,0x7ffbcc6ac1a0
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,4010223028335752634,15773337431955660194,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,8573471191420227638,804412691034862922,262144 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,7599647608968326520,11391014076185179338,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,16114886606464235896,2934669286745531667,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,16114886606464235896,2934669286745531667,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,9944681627650717208,1222400855668227139,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,11422537750401841913,11251320695869732571,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,6283605992387517438,3196780221386434856,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3012,i,897684607832429219,7449943000747043386,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,16256515466430979422,5180159585990680248,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,15926047969853951001,17647553802334891790,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15822007398815470287,7152934823946045757,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5092,i,16800695726276452557,7426781062319018150,262144 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,12558095666488190385,13810304631906020007,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,7898096006580125054,10879741628815397253,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3252,i,1378965694072061716,1195743943679568904,524288 --field-trial-handle=2172,i,15167311652569770103,9128622784758697705,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
    3⤵
    PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5604

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4128
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2596 2704 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4152
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2600 2712 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edb.jcp

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp
Size 8KB
SHA256 dac8e0a3d03be7838c2d8c137552a978b5a415121e6ebc8b79a9c2af844a27d6
MD5 90f67539856f3083a40557431a790ac1
SHA1 8da345ab9fc7284f7079e645409d3ff63b8844f2
SHA512 11123c116369d7a259ce87ade48d9d82bdf28979fce2f3a4731d0679d6eacedf9639e3e4fc3bda731c381da095d33761604021c0db3727191cef720f9064bee1
SSDEEP 24:ltIVwd2tIVwdCl+1CEI3SFMqitIVwd2tIVwdCl+1CEI3SFMq:ltIVwgtIVwJI3SFgtIVwgtIVwJI3SF
TLSH
T117F12B466BE4078AF6F33A72868A96B8063BDD6DBBC0C10A810A51495C14E16EE72763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e7ec83682d02d78d1a78f040cf49910aa3e4ab9f549b20c180f66e28a36e6d53
MD5 88fee1c4d5fd932e272b3af1fecd5b22
SHA1 a781d685506a2eb22e8a9441d2b90426fb9bd768
SHA512 3c3bdf8469abd4be8e38ca9f7f9560136c39503b7462ea1e45a2a5109d70d48ce808b2c290e09c05cd2de79ab98656d181f37c69a1ddafc3a2d23248f90772fc
TLSH
T101E02BEAC826DC375CFE075890905742F654135B2741C91F7A3D860D8FB163F1985C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 50KB
SHA256 f410ca30a0fb8368148a5088170cc9d0bdd11b0ca245a25f2e74d6419a716d0c
MD5 37c228f8550e292e6152de641247ea83
SHA1 f8af02382e23b3e1c038c2badfb738733ee28712
SHA512 f366b6312d8432aa1f84111a9b44439296f2bcab804d4fa6025008f709ff94f581e33bc3bbf77eef72097031b9d0d2698fb821bb6110d76eeab6029cbe29f507
SSDEEP 1536:I0Vq+SvSzUHZCA4KiXHKjvy9k57isE6vWgy6uLy:7VUH4wEa/Ejg2Ly
TLSH
T1BE3302F56C181F6BAD28761C57C3FC863AA80CC87907C111ED173695C7BEAA444C988B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 ad6dea8a8ca3f299a8d89ddc2a81be6769d11346f130c3fdfe68c7d01e829bf4
MD5 05c0192c9a0830416a14e1b524ac39ae
SHA1 a69b3243f5e373fdc73296d4bbd0fa2b5075fe68
SHA512 83f5ea1f09a9f710ab5306c85ff1796a6d024398345f8caa61706634f7367dd593c5ec1c9d402f612d7972fbdc80de002b101ee0b223689e42efb90570f081df
TLSH
T17E0178435CC49D22EF7A0DB490411C08F5DC39D79182379322C9FCA525E32F462C26A1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d932b209aae37a81aeda6bc090402e193e59fd9f92311eee7e36e5353b937553
MD5 4fd89a4fb039bb374a931e9b9f762af1
SHA1 9f52014e5913660325f6f1f5a3f6a40877503a7e
SHA512 62a7fede77fd98cd97960faa59a848c93bbf40ed62d2839f89f28ac47590e559070a4203ea5455a2d5e15848181e65196a5237e3ca06c4ba987961ead6bd9012
TLSH
T1A8518CF393E4867D8511A2E4EB256E2FDE6D0A24031D3C62C8D4AF4B43F2972D21179E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 dec0025b1fea46f7c18a22c169f297b1a4a08a9d95f1984cbf3ee0c22862b53c
MD5 bed49af2c5f632972f2d031b097f07bc
SHA1 fa4691df7a827cd59770b68e4efa2ba3cb4d7130
SHA512 039146fc6d091453d1caaf7e670f092ead818f7ea87dfe630d514281e37d2f4da223cf54a3ee3bbadcdffaeecece83a03a88f61f29fbbca2231c190cd097cee7
SSDEEP 192:DPgK8ry3/rSTOFpaIaJT0JqobaIIX1woK/Sg2/O3/Y9rJ/b6cCD:DPgK8ry3/rSTOFpaIaJT0Jqo+IIX1wos
TLSH
T107226CF3C3D8C63DC85162F5AB257E1BCE2E092453683D6689D4EF8B93E6472D21064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c1ae5965ee19b0622cc70e09c648f9f93c36f7e640395308ffe1c175ffe1e406
MD5 0bbc0ae43e9e34ce54fc7b0be2d088c6
SHA1 f25fad89c6688fcc9230783b0faea3fefbf769b8
SHA512 d86e29ad4b4023387f5d38314711e2b6030318701567775072d35bbba9e44955eb2f90af4431521b7d1f74b218879533f87aef02b3262a8a0d7e01d2191c5edd
SSDEEP 192:FRtuG8j6Ov7+FpAPRp239hHsb+WNnlV0pr271mhV7szhVyIsnAUgtaJ:FRtuoq6FUXQbw70d271mhVEH8
TLSH
T18D42C76EF914657B9CDAC22AFD617617D7F5103120942E88EAFCCA2C15FB5CE222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a431328398be85b89a03affbb2e8dc5787773f3d4942977c623099be2dc97174
MD5 5502017fad559d19390a5d29d636862a
SHA1 2a0b9382e214cd1602d775553840662bffebb1b1
SHA512 1a25170fbafce44c0e6a53657dc23acf18baa0f09ba304b0afc7fcf576bd8883f00b702f1cd936dc820e6dd8a11516fabcab1bc465c10a6df821699a718754da
SSDEEP 192:FRRcBzuG8jeOv7+FhrPRpnkI8s9hHsb+WNv4Ebr9L2iRr271mhV7sz6VyIsnAUge:FRRmzuEq6FFX/bw7N2I271mhVE6e
TLSH
T1B252B56FF510697B9CD6C226F961B757E3F5103161942E88EAFCCA1C15E76CE222301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 202d3af18bd161a2d493c71c49976c487c4d2e2e31db47b012cda82f79bc28c7
MD5 92a03bd47c6badfc490874e64e8a03af
SHA1 30ce4ef6089fc3e12221fd560abccd1b87efe30f
SHA512 672de0a08d30c2c43e1c9d1f893db83ff7b422cdac69457a2b7ce8229797ff30814e0c8c079f065487ed986d4dd574f443399acfce4495cdc0354b5d06802cfb
SSDEEP 192:FRiuG8j6Ov7+FprPRpn39hHsb+WNnEbtARr271mhV7sz6VyIsnAUgraJ:FRiuoq6FdX3bwstC271mhVE6e
TLSH
T1BA52C72EF914697B9CDAC226F9617757E7F5103121902E88EAFCCA2C15F75CE222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 166KB
SHA256 584cd3de95359978f5143d24f843187d7f4752662bb95ef908d773e40f93b545
MD5 129923d8309752c3838049970c0928c2
SHA1 fecc346faa87535eed23a4098438af1fb6977ca9
SHA512 05b5759ea8502f57cbd710a2fac4e7c8b454bad1a2aa8dc979bc1b8941bcb9e677028fb2a35224dd6d572839abe3e7724a6e430382c826e75fcc0aaa2d0bc437
SSDEEP 3072:+Qe+sswSjnxPCA1j5vuDMht5NvawiHvwRUt7m1KU9C1+tTl:+csswyvsc5MwCvwRUbfwl
TLSH
T1D0F38246D1F8D863AF7B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ba723f307762b9eead14b016ab1c65fe7a31073e9158936d58308488a4fbd3f9
MD5 07c0bea1b92710b2c94770291dcc3842
SHA1 8b52b0ecae08949fbe271d2414c313fbbe6a6382
SHA512 8af00c43051f6680196e4d1bb1ea4d3d7e96bfbc01dfeff1baa2f935fa9a54945d8b06c9fd1123ce8d4812c8dfaefee732469266a7401d479cc4b08d3592de70
TLSH
T1E7B00257C50F7212C04207B02EB5A6D8717DEF25C603165693E45EE6DC2677046675B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 d9119a9033b11c96437e29f04b74a7324abd87474853c3408f5be1e329cf845d
MD5 59b6fc6c61a4768f5082af60d1e01852
SHA1 dd6f960599e65ab0d02cff8f324b548d94b9e3e9
SHA512 4bce9674f06757eb5f423197482c2284dd012206a377c02154aa072e778a3c6131924d7a2f9d510b7dae21b67908eb396a4707e6e3fd16f3153dd3fe3972ad58
TLSH
T1CBC01292C105F121C40703F918E38CAC791CBFB9DA252B4857F0AE3AA835250C03917A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 988f59e8eb839afc9fcf9cf499922c5732fa4137fafc06db333af22d72c454c7
MD5 e1b276db4819784c3cafd1a626201cc9
SHA1 76600d7bad42d02005219fd165a67c126501dda6
SHA512 69684863f7d76a2f2852362378e1bcbe296a28ac20f1a2173adf45770a2ba9c16f5ee9ab0c00c6243e1f9bf63c1e6bab9300b86667791cae9705e944dd0e0c33
TLSH
T1C9B012B0C4415703C81302F925CA04883118AF32C706130163E0AE7398261A14265150
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 621b687618b4b43e6ec14fda133e68259945b0956ae9345edfd77a22aa662599
MD5 a3a2b7a039b20d77f647b4e02b67fbbb
SHA1 a41cc773c4d9f8771213c2b1adbe79cd80a4b9e9
SHA512 b68a6ca82c13b19e6abd3c1407b907413af9832e68505829f22ee195874b97f6fe7f30937c7fc7121b820a161a9e251509062160069cf5ba125a06757e7e3dc9
SSDEEP 6144:tsVUrE4ZI35kqZ6HEe4S++JjcMW2VcVL9:tTE4geU5e4MOMW7
TLSH
T1E61412A9EC0D3DBA536F8297E0171D5C4EE58CEE4411B06C30D29F5E18AE7F2974B8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 1892e1e131be238d735d853b9ba94df1ee2233f885a8c5f1cac3ea64f3a8ffc8
MD5 d5ce6bf75b17c94bf2ce2edbed3b364b
SHA1 15893e400e26d83fccf106780a5ddf751b50a48d
SHA512 fc0e208d1ee9c11706542a5fed653b931b3bf6085276a6da674f891a5c28c78676776ddc9a5cfc61ae87dbf09df29a987aef930db43854e9ccf757e533e1d444
SSDEEP 6144:XFyVUrE4ZI35kqZ6HEe4S++JjcMW2VcVL9:XfE4geU5e4MOMW7
TLSH
T1121412B9EC0939BA536F868790071D5C4DE58CEF4811B46C3092AF5E18AE7F3D74B8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 a44442ce047843a0c4c3f67c47f726240a4fddd051f6460006161b25f6a40851
MD5 d37720b9badf81130511a3fa527453ed
SHA1 280dce9022f9b77f5eac0d348d3a065288ed67fe
SHA512 4853b6a24b3b07f534a16e3cb37eea6ad3275e3789888b0cde242b9f979e54e0bbeb1ff5c143c524c739aca4757bf7e291d9959fc6c6dcb226dda75c4febff96
SSDEEP 1536:eGIbbP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:QT++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1D59312B9991E7D35636AC6D690079CAC88E3DCCE1514117C30C7AF1E28BE393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 e43983d8185d933f0c4c0eecb4bb7eb7be23123e1a90920fa84531fa6262bb12
MD5 0f0fa2bce60b3ae2778103abb3c191d8
SHA1 3d5feda97d734c4ad30d8db3bf7fa3b469584ff4
SHA512 ca1045414c17f26716bf5b4c506a049116f6497fa2d7498b57338584c40e41522084692e1a9d13a477b69b2e8c901be70be0f7e13ab7ab2c8c78dc07c74915ed
SSDEEP 6144:CsVUrE4ZI35kqZ6HEe4S++JjcMW2VcVL9:CTE4geU5e4MOMW7
TLSH
T1DD1412A9EC0D3DBA536F829790171D5C4EE58CEE4411B06C30D29F5E18AE7F2974B8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 0b406dd6d7a120dee0d3c266b9f191962b40ed2122df4120c4eb41b27200f206
MD5 488aa79bb09933252fc15a44f3084f6b
SHA1 65d1495b7dad73c9225eddebdb38ad427803bd45
SHA512 d1cb219768acb7e3ff177acf49ec5566368a145460ae576427f83efa2147ad0f7969cb8a9701b5904bd0b24978bb42bd59df7628b209d2c3cc2812fdbc489943
SSDEEP 6144:nFyVUrE4ZI35kqZ6HEe4S++JjcMW2VcVL9:nfE4geU5e4MOMW7
TLSH
T1CF1412B9EC0939BA532F868790071D5D4DE58CEF4811B46C3092AF5E18AE7F3D74B8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ddeb419210ce4199db863146447f6cd46ace6bede2983be20027867088d00a20
MD5 0bcc8744c7d45c98094be42414b04535
SHA1 d1f718e5857f4cacc569fb26c1eaec301ab26152
SHA512 22610ccf9ee91e5809424a69309d3d096fd06c1e16a1c55abfc19f0498b78d1f90a5d213ab40bee36363584e6e4ac126766fceb1e8b589b6e46e9c87dc3b0440
TLSH
T12BD097342676B8A0C0050031882123332F0E88C12CC74B11F004909C8E6E00083D12C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 04915bc5475aea995f7aff2960807d5ba74abef13257da35967f5630a03c891b
MD5 35fa3310b51d67feea5446b2706ba0dc
SHA1 918c6c19efadc65a3043279f7beeca7a588b4407
SHA512 93e432fb7ec51cc6a1c8b9e49b408ec9c4a016ec34567d2d3c16c14f982d8425370eaba813f09ad8abe17a7781c8bcc3d09b50858fb09ba296eb11df0edc0748
TLSH
T1A4E02BAAC861D86708FD572964544A46EA1113271B90895F3F3D850C8FF1A37059585C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c915d52b37cafb6b2ce3455227cd0a4e94258df9b4660323e6cc4fcb9b544c50
MD5 687365c21429bbeb8b19b20a218db91a
SHA1 91006d2c8542df416be981ce122a468b6c571c2c
SHA512 15ff9bcce478182e0ba9a727f5adb7b3d73beb3a85f5683edb76fe8cc3744e41ef367177a42179f391337b12adce17284e38234a224228ce3f27dc0824be2e8d
SSDEEP 384:Dn+HLcyzYkwjAw9u04HMRk/N4BdKrjqhNtvdzeS4g0:DKzOAwg04HS8mBdKEJdiS4g
TLSH
T190139F3D323D6D05CBDAA83C6C1FCBF42B31D625C6C95A430A3635664BEE356BA6E110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4235ddbe7a984f44ebb0cc839248bc4143f9a3b45f1c20bebaab983bf11d650d
MD5 861e081bf8c5e963f53109bf5bac1aef
SHA1 ae57d70a5b719ccb9d49134cb635a7cdf6f27e95
SHA512 e7cf76f6ad32613ee99a5a912faaa1f281fd373f4aa0266455789f9d61a3ed2db28c66d5a71772700eb4b2295caf6816c8715a32da46f264897b07c106842dde
SSDEEP 1536:RnkYRoWFW/52p6oS3D1oBYQxKIZIguW/yVh/caqqkH6pI:RLpCdzMm1cpqP
TLSH
T19A4481F70955A01BCFA802F5E2073E3DD577005D6CE1F8E9E67C0C952869B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 0c2c083de8d54a24a79b2ac1654f1b467f75447b6ad18ad336148d340a339614
MD5 8b89bd0e31acb6a3d609d02b48ed30ab
SHA1 f5f9832477af5488c8eca2280666b6389101b930
SHA512 3daeedbd5599c1a2998833026060e1e4c077dd4abdb816b566f06c2ac0579d9c15b93fab9545a556820e7f01a0bc1166f1cbb00970dd98ff0da657b4f60d6398
SSDEEP 24576:JnWlniTJwW9B0IfrP9FujP27/982eJJyDbcRIa43J1OdP8PYJOtaryout5l:9iiTFmIh0jua2eLClae1OdkPYJlmt5
TLSH
T12D867EEEC6785C83CE678A70B4E0EC477C7412C3B555C1D38958C59802AB7C5BBEA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8ad0ebc0a1115e746b1b5c4aa70ad26f9ee93ebc22d02f5d7ae66d9d5bb614a9
MD5 477ea1003a51b39b96c5390a783f433f
SHA1 cac527e06fb4c794b74432e5200ecf3e11d82335
SHA512 5c60f0f6b934090bd10e5e391a8ebfb5a476180fe823458e36490ef601c96645ff948fb3ea83258072064df3320e9fabf57267182b0581126149ac5e34b125a8
TLSH
T124714EA76172B829F3E0CCB811D990BA7671F25FB24B1E4B81F1047E861DB33A3444D5
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 3bf369fbedd3b415551a1cd76dd21479d52f23fbcde700fe0d1805a36c0b2009
MD5 908c53ad4fe92209c6e5c2eaf26cff5e
SHA1 d996a7cfa88c054d0f20973333a0c54e338b8312
SHA512 4e0ee8bcdcb75d6e92c9159f1b96afdce641312c14750560618fa4497b3b6cd6303f83d7d5d23441063a62dadd16621b052576b9c891fbd9956319ce1c6fafa4
TLSH
T1C8E0D8D4A4C6C15E6E907492423CA74CD3F13442EA96AD932B0098C5BA02541B283546
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 a91640afec6ed45647d777ee235d19dcb65efd96616af768d77a230b1b0cd819
MD5 0de457863e8b0ab4e2aa7a5baa82a2c7
SHA1 7c7671f3a3d923fb83706dc8f86be9df459b964c
SHA512 5bec8ddb91d9b20c4e3ead4d597ea21eded0758dae53f3c1bd6e9edcdebe47665f159ff909e31f133c1e3eb30eb3c9c0abced17097ffd984464e549163d5d3ff
TLSH
T1CDE026A414CCC2EDA89578A387AC6308C3E03402B3C83A6267089C86A102241A2A72C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 b5bbcf5f8c4dd0ac011e866277fa141916a5c2b5dcbdb76f005c81066a505132
MD5 674c9a0a3c3bcb226b7c1ce039fe20b7
SHA1 39bb936d38184651d7e49943fb40de3c7467ecaa
SHA512 c4f29dee80690f066f46c4e1abb02686b04b50c15f30022a442f1a0c58ea06d555b13d2b7bdb5a7b5f9036966b6cfaed4257bd4f87aac03da6f62272f3e89bc5
TLSH
T169E0D8B158CDC15965883057831C774CC3B07406EBCA2B512F04FC46B406004A2831C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
MD5 212844ae4e887a5d73165134874824cf
SHA1 10e38c395288c68718866ceedadaca7e6334eea7
SHA512 bc2273db82eb0a9ad6370a777eec735584b63f15fbd4f5791b53ff145f8d5da06cda75d017f70f112cd78f20ab23d349f85370858c08a4556f351dd73511e76b
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T171928C4E5F346220C0F04B36EDD185672F7C211CD3A72A99DE5410F3DE9259BF1155AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 24c4db3dfb949c91a8a2b88c38d4d794c7a91e7166363fcecda9923856075334
MD5 844910b61309094d4d97383e7c7c53b2
SHA1 78f87f5b465361a410f280e8d499b5c231cfafd8
SHA512 0ebd2cb2ece45260624869216a44b57c76cf4ad2b295d38a2baac896632b9f7888f9ac1285fb1caa99c6bcc3127aa02d87694918b38915898276d03fc992811e
TLSH
T1B241DFF783F8857E8A0195F0BA187E2BCE5D0A50436C7D9AC9E4AF1B93E2470E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 22bd86425813bc86377a42bdfe0051237aec57c037c47e6958d8541d174d571e
MD5 b7fb173339ca9561449f3b94026d3d82
SHA1 68a10c0abfb50b533123d6213ffbc185c578e2e2
SHA512 990fd1ec69c506e75b3c2268f14f17b231a090940280d3dafd021429ba92edb11aab1c00a16496e96fe7f805b89e24e2758e82a57bc64a48f2a8298cb7dd8d06
TLSH
T18F31CBF743B4956E8B1196F0BA18BE2FCE6D0111436C7DAA85E0AE2793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 1043a33024be02a0b4b29dd8d0ed7ae7503b360b3967180a38a76e051528df45
MD5 92e707ca054cdee71c5d9541f7fa05ef
SHA1 1cf3f8929be2a7f530121473fd43317e059b6fe9
SHA512 d90edf6c5cd627900d0c3ba9d5f03c70cfd38145baf39c9775dc3938f17a0e665f1613944a0803271c65d5657bdfed060b8523043cd7b9ead95254a99b6c660e
SSDEEP 96:+IEumQv8m1ccnvS6o+37bNWfmnFB1HY4g:+IEumQv8m1ccnvS69Vc
TLSH
T1A9F2DFFB07276205D98444B0E400AFCEAF16404B47B6B6EC76D457E3F3A25E2B1B9786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 7e269483b52ca82ddf4781c97427494993dbe1a138f640d381981d6e9fd6eda0
MD5 18d3d9f1850055aacaafbfc596b834a5
SHA1 0ddff7772624ef9d750d2d9a178c57f73d57dddd
SHA512 af6c17eedde077424f96f8d6d2c76593f2be58b88107e372842ed330de97b7aa079dd4a11d3edb1e1ef928ff63558b85a929c407a5efb7021f9e8ea0bf90f73c
TLSH
T1EEC0125284FDE8735079457A6984ACC1B675D834014150A2DDA6823CA1A14B76A3603A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a6e78117c8bf1ad0dff0d27b6d4271bbf256af3358f292d87c767ea68336205d
MD5 8c4121dafccc23068d1b9f71481b2faf
SHA1 fe0aefcec3926e54173dd32b234f8743ce834690
SHA512 3d799281b316cec2f344e62fd507419340eb33b3e59bee59d147b17fa93e9e050e949af10b5863b6d577ca53e3d822659cf01b9ea15a49bd8fb96cffaf30c157
SSDEEP 192:sxZfvCRTyMqZ/K1Ml8jc0/fase2WpVnQGi2IIDPUpzodpgzG/W6+WNGY0MTFe0e7:sxZykN0/fase2WvnQX2tL9H/bG5oKZH
TLSH
T15772E8096A38997BCCD7D209FA557F53D7F91523D2914E589AFCCA0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 8ab26e90b12eaccb690711660f15cf77f9504eb95e7020f37728ecfef3811d9d
MD5 d8717fe813f513ce92b3ebf97d63bfea
SHA1 5d1837cc41fd95b89905416e261cb0779dc17339
SHA512 9428210b609e379d3837e858614f48186edef1753abe2d16d318ceb1bedc615b304b1a4e8453a24a38d7ed76e0355959df8b2d440f34ea229f0cfa22da91edc6
SSDEEP 768:UgjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BDwvLlC:UgjXV8Zp2+GE/AAWRmAoQ7ku1jaKBDw4
TLSH
T1F603FB3B280CCB7E4F844E9CEC26BE9E6DE8018B9698895447EA444C03C76EF551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 b3ca80e49f9dd6ae702b8fead08b5799a3f902bdc9e2dc14192f598c850e7a18
MD5 ca73028b72882ada7e8d098f14dfc973
SHA1 4b8d99441ca121bcf66a31ccde16f7c362010df6
SHA512 a2faf7f6fd5d816d5162b2337b4d33fb7fb93e0acd7dad82b54ed8bd25dae338422a7132b7afe5998a92d31125bd49f21959250cb4e3645f63d789837614b710
TLSH
T15AE0869059C9E2BD75573143036D930892F47417EFE83D623F55D9456547544F193181
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2bb70f8d5bad87b9125004cda5beacb896dce6a92c7a676a04ca95a7b12f0014
MD5 f057cc8f885b6c9fc3593b092ff7c9c5
SHA1 e2d72c4dae9d6fc07789363477b9afca3fe4d05c
SHA512 31455147a8d8ed4ffcf2920fb8ccfe666895907a8db207207987a4bda3b7fa68de9b678df38153d7043eebd334e586c942099fe003d6160a9352170df119c15b
TLSH
T1AFE0486029C9D26A75863097935CE308C2B67406EFDD79717F18A5D7660B1447253541
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 a97eea45548630c41fba21526c0c7beffd8842d13fe19e2120e1b0304711e20e
MD5 1dce9cf79f99531f08dcc4e5b068814d
SHA1 b27774cc852f840c802196034a9fe83560a8729a
SHA512 4904cfd895a726173c92d11ef6ff57b9d4ef1c94c2652b2f566f94e3b13cd69b066ded24c4a47347f2ebd9328f91b46bd3cf9cd59fa2dc7a19ac91a5d92bec02
TLSH
T1A1E086B095D9D37A6584B0C3437CE71DD2F07807A7D83AA6670C54D6A607144B6B7581
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 80b91aa5dcdb47ff6dec8f709dcb910cc49214b29e9bae0424d47a21f0305df0
MD5 0f28032c011fedb857c956d4d522bc71
SHA1 af1d4ebc9210b28dc5655e7fe57c334d2db632f2
SHA512 a49b7c359a10bc41d49aea66537bfd79d1f0c325a92302fa233ff8c92fbb05aec53e3e05641971289071e05427c06db6121983205e29449498da02a0ba41cc99
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa20i:ardVTNBbfw8nM9fgzNJ9dvz9r5tbVg
TLSH
T1D0B23941357B03C13ABE259A81A1B5AF56C230633118E83B3BF851E64F66E24DDFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 e90e6ae48e8088e5dcef8393588c25b6c9375e0c94044eb2eed3886e8fe011a0
MD5 0d2fb719fca86f28d4ad6e42271be293
SHA1 8d674f5fd0f0cc49d60d9d0741655daf72552d2e
SHA512 9b82141afbf6633e72589bb92c95753ebf983c608604ad53b411ec5d3e0ae065d3a6ee37454fdf8f85cae46e5882fb3ae7add3ea65839ff89cf6790bdaedf2f6
SSDEEP 192:FvoWTgM/fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a+nfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1EB24640A7B747001EDE7D9725CB080771A3CB16DCF22A6915DA264698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 7c4a159b8ce24d227a5488c7e37d163cb2e931aea2ce077591b2db4597ad2aa5
MD5 95084331a639c299990a030f0d2f59dd
SHA1 88845c1a501189971372c3963d26eaf96f7327d9
SHA512 4432939b854019c8967adb46b9ce79c7b1e7bf7140db62c6bc4b3be4703ff1528eef9d8b507fc6e41343e793605b6c53c0b505919d3f1343023206f310189eca
SSDEEP 192:KAOrhAsllrwPrsHAHu6B1QvIIIebOMIMUbZYcYy9:Gris/usg3QvIIIebOMIMeB
TLSH
T1A65282A927491B33C14F5FF6026ACB941BC58C815D76226D30202D4FADF2B579BC52F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 9b4f0c1cdbf58c8f2a998f683ef0180a598873252ab599f446ee3e6ba309a85e
MD5 be61df9d5f4616025cc6dfec9381d207
SHA1 c4ba32f281eb5f681730c904c88890e1eae6a7e8
SHA512 7c33b414d0c606f03088fdcd67242c17cca974572eba873aa1b6f946bce28f7cdf0fd9164a3fb6ad86a0828ff530375bd20553608f58a8f08b3709a4f0106c2c
TLSH
T123E02694FACCC1AEB5D43087422C9308C3A03843FBD829A62F00C88AA446500B287581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 7d2b732af57036c036b813f56c2d5b10132bd275f0cbe9f8addf00a20e4c5992
MD5 6381804ea80531b42d30478fe754e43c
SHA1 8dfa8c8c67e129cd1afcfd35aadb4982a43fedc7
SHA512 f152a4b4567e4a8732798000c22df80d813a643986a3d0d6afe2d56035245ece541a1509b0987aedf47c11d85e911500f8c7ea26dc2b720cc36470a7da14f7eb
TLSH
T13F212755F320C208D14A823EA42B9B390338E8129FFCED0F807924356D75F040E8B7E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e71995d35e1ac61591a6f82d446a27644e49dc95de7980cd48ce1c5aca3102ba
MD5 4ecbd35699903c7c7f3140f1a40c794e
SHA1 25dc5dfd79b47766f4f779141dced1cb1d12b93a
SHA512 4d878ef98818c02c44b6e995e67257496e35c6672ab23a30ed89549758e6d8bdd04ed3090b2277f5055a091fe98f90f575ce8ba833324f6a2609ff412bcfd794
TLSH
T155E0206474C4C1DF609030CF027CA34882A57807FBE42E933F00CC495506141F647142
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 7112104ff26e56fe640c28aba2c6f099a02a7b4ab27f820d2eca7b1868d64a1e
MD5 37b3d68c05768876a91b801710c6dee6
SHA1 4f350b7660acf8b71087511ce0977aa25f40444b
SHA512 fcf6a9f9f8538ffdef2291094a8f3dd2bcc4196548b9c86dcda5f1a0e2284f888ba69a2d496f1f1f59033910b34ab460f127512f3eab6791cef75d917f19e167
SSDEEP 3:MsEllllkEthXllkl2zEflwiKl:/M/xT02z0
TLSH
T10B44040C7FF40507C54010304071D3501370D5300D1157C334D1043F7DDF5571D04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b201cad0a55e57faae385af7696babc655016cb8445d7b203745d6b3ac0f79bd
MD5 38a6aaa64d57dbafa14e44c9d9810088
SHA1 f58f12bb9e4757f7cfad31d648b4601e5576acea
SHA512 b2fbd4b1ff5f58f68a97601c4f5445355235953849d8273110dc7c2fd4f721f8b2be74bb3ae8ce02ca0cf2880aee9cbab885376bfdefc1d4a98de8fcd9a0e5cd
SSDEEP 384:nMiFGvqMS8NY8TUNTUlIRSvHeV8BrfRK7ge+v27SzRU+jKNWyQAVKQN/YA9GdrNG:3FGy7Dwgh8K0efStUMKTTKQNAAgpc
TLSH
T10EE22979DC55897F98EEBF89A70E2A169DE40177C5A88998D7D50F0D80B708EF30B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a24cc15d6391e306e0a950adebe8811b9dab1dfbdd71da015bd45501a966a350
MD5 aa9f00ce9669e55c662a8744e6897c24
SHA1 76593d5ff13699582032ca9787199f8162913cfa
SHA512 265d64a0c2fc38f3b6d2a7148ae741a7bba6d7ec981b83962b2e5aba240a920d44a5b4d65968f1408477927684c627a66158c2b9831ead71367f26b79c5642ef
SSDEEP 384:nMiFavqMg38Nr8TUNTUlIxBvHTWkGBrfRK7ge+v27X3EdnS4mtmEerNlk+5vI+P:3Fayv38wgqk+K0efX3EdS4smE2j
TLSH
T1EAC24B75E898DAB7EDE78FC9A7097B16EEE00197D98C4AC4DAC81D1E00D719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 043c08bd1c978a724227c9129061d81df5952f2f9aa2911a597bef25398d2345
MD5 159779fe5933b0bd351a9bcbcf469191
SHA1 5f3ba164b9124baeb315db18a2e5455fb37af1fc
SHA512 185b06bfd545fe277ba85875072dc26db396d7db9645de82dac48424f32d149be539b5ce7a90ff73045d6eff179091fb1ff2f711a353ec48567765420c2ee33e
SSDEEP 384:nMiF8SxmoWV8Nz8TUNTUlIRSvHej8BrfRK7ge+v27SzRU+jqomO9GdF7Ig5eh:3FBx0V4wgP8K0efStUMqojgXeh
TLSH
T127B22936D854CE67EDEA9F95B34A7647EEE0016399CC8ED4EAD94D0D00CB1DD130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4fe715b23935f2c25932481a1d61bd5f398bb7479a68f5d3fccad291eb4c06ea
MD5 028c795d1ea64ab1cacf5782cdad908d
SHA1 077cff7e0f030888e4c5df0f3fc91d47a62b57e1
SHA512 025d3c0cb25cabb4f04d0b415276ac2957030c2386b6ff8e90105d79a9d3573c1a117c454e93be6b7cfdb4fc2358001918afc6562c90475b682087d3b8cc5ef5
SSDEEP 384:nKiFavqMg38NU8TUNTUlIxBvHAM5BrfRK7ge+v27SzRU+ja3fIdnS4mtmEerNlkq:BFayv3TwglpK0efStUMa3wdS4smE2j
TLSH
T102C25B75E898CE67ECE79EC5A7497A57EEE001A3D98C4AC4DAC81D0D00D719E270FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 99a1ca799d9a14ab2663afa0024dc86b86c80676b5e6baaa52c2c09f5c3290e4
MD5 a4f0ddd31054ae71bdb626fdf153c441
SHA1 abb19aeb43c29818b53a9a6578df84fe5e90417a
SHA512 8256ea1eb4efc5d64c6022b7cd4c49f8ecb284709b87d1794c8adf17d60ffececf5ddfc6b1defc842b76c0bf76a22b29fdb49c5820073bab5d51bb74bcc26e4f
SSDEEP 384:nMiFGvqMS8NY8TUNTUlIRSvHeC8BrfRK7ge+v27SzRU+jKNWyQAVKQN/YA9GdrNG:3FGy7Dwgu8K0efStUMKTTKQNAAgpc
TLSH
T12BE22979DC55C97F98EEBF89A70E2A169DE40177C5A88998D7D50F0D80B708EF30B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 451c84615366e447975879337cff0511716f6904a541f14448e6379b93917ab7
MD5 de27f27ec090e2c641e6cc6600d8d4b6
SHA1 2ac246581e88ebeb9acb28915edb7cf26c68628c
SHA512 f40f4245d9afe276d09daa063e24f83793ab2b51eab9dcc97222d52815718940869ec07c22ba4ee28b29a640653c1c95f38759337adafc6ff4ca7de830f394cd
SSDEEP 384:nciF8SxmoWV8Nz8TUNTUlIRSvHej8BrfRK7ge+v27SzRU+jqomO9GdF7Ig5eh:HFBx0V4wgP8K0efStUMqojgXeh
TLSH
T1F6B22936D854CE63EDEA9F95B38A7647DEE0016399CC8ED4EAD94D0D00CB2DD130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 24134dd57dbb7e654b2ccc98a0c5ceb3734743c764e92536103780c787df4b6c
MD5 73971b84bb423ee596e150323fbdefc5
SHA1 e88d2b065fee4b02d4513d571eaa44ac2708f5f1
SHA512 46f6b57f16716d87f70b2908d57ffd34ddfb935ad49404dd30c8b87834587a321eb62fc96ad31f37ae3051328bf4d30e06d0f069d15af6c764ef7cf2d3e24798
SSDEEP 384:n9iF8SxmoWV8Nz8TUNTUlIRSvHej8qIfF+d6Y7ge+v27poSEdqE1AchGdF7Ig5eh:0FBx0V4wgP++d6Y0efpoFdqE1A5Xeh
TLSH
T1B6C23A39DC85CE77D8EE7F85A24A76169DF00173D9A84F98EBC84E0D40A71DD630B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8e5db25cafcfb228262853d9c18c79f7072ed2754021819a1d9fbb78c616196e
MD5 cd739b73913dbe34d38409abe2618995
SHA1 62c97dbf547465636ed9a59179572662b2695c0b
SHA512 c591452964e6d7d38ab4bd66fb336ba6378dfa687414e5923c26fe723fcabdba07c555b952c7d28b30149785b33e053886cca38301d8f1444fb2c03f032ab54d
SSDEEP 3:MsEllllkEthXllkl2zEflA2K:/M/xT02zf2
TLSH
T1084404057FDC150DC5403030C051C3501374D514051177433CD1043F5CCF5411D0C101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 46281968ae885c2c8c799643c296d4566b0f4732a2e8fa9571ea6b9093d4edbc
MD5 7a1eccaafb3d05b82a95b5f827151a85
SHA1 1e85cc4b5b06c1e51eb52a54c0625cb4e275598b
SHA512 ebd13600734e4ef2d0619a877c64e7ef8a9596bafcbfed66cdac8f5e6783d7a199e041ac16ed600e3476fd30a694a4c121f8425ff71b7718c2149ce0e3226722
TLSH
T1EF4152E15C3D2AC1D5BD0A6FB48B34FC92ECD71AF4A4343D6814E9C84A7A20D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fcde7c6957b5d403992e4d55e7e639e41989caee045682949379d8af361f90a9
MD5 82001f1a7efa46e9cd2b856ff741012c
SHA1 78fd744f3e593dc10f332c7f00792d733e412521
SHA512 4223f6d8f4e297cc8a7c6562e75b58c7cf47358433ee6c383dc71c7d7c9349a10224ea4d0c57b7c4f76443444a73549019f0f7ec585259cf7fa1e1693a99c25c
TLSH
T1CA414FD19C3D2AD1D4FD1E2EA48B38FC91DCD72AF4A4347D6828EA88463A61D604083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 485572d15a1d9458b743364ad3c58dd375f31661783ea8d32c933a9a1225c83f
MD5 b71cb86aae148f86dc8cee4e4fe4d896
SHA1 420ccdc6c3099b4668ce663ddd1f517406d90fe0
SHA512 adba6a81942940cfe3a27b6011f8e9305aa3030e2702c8670afe77e8a353b2ac7d424ac98064433963c41b7ce77f6bec15e12d215c0670624199947be33bd114
TLSH
T1994150E05C3D2AC1D1BD1A2FB48B38FC91DCD72AF4A4347D6814EA98463A20D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f62345482c0c454329c0d955bc01b59207007b1d67cfbd5e164da9130b58aa3e
MD5 d8aa95e424449173f7c7c9cf7324dc7a
SHA1 ebb04e050c9521f2cc299dbabcf79b00c34635e7
SHA512 7abecd9437fd46a627d135d7f5a5f2e9ef69e9887f1086b0d7699e07f4446a707180e1639199aff5fc8c8419e08710ede33034c16abf52ae7eeca680854910be
TLSH
T195414FD15C3D1AD1D1FD1A2EB48B38FC92DCD72AF4A4347D6824EE984A3A61D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

123ed25c-0385-4be9-9360-d6fe0e13e78c.tmp

Path C:\Users\Admin\AppData\Local\Temp\123ed25c-0385-4be9-9360-d6fe0e13e78c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1614212729\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_1614212729\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_286538765\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_645065896\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping384_76918892\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1396-788-0x000001E6F1560000-0x000001E6F1568000-memory.dmp

Download

memory/1396-675-0x000001E6E7B10000-0x000001E6E7B20000-memory.dmp

Download

memory/1396-691-0x000001E6E7D40000-0x000001E6E7D50000-memory.dmp

Download

memory/1396-707-0x000001E6F0100000-0x000001E6F0108000-memory.dmp

Download

memory/4152-753-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-771-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-770-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-768-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-765-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-763-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-772-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-773-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-774-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-775-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-776-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-777-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-778-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-780-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-783-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-782-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-785-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-786-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-787-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-784-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-781-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-779-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-769-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-790-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-791-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-792-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-793-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-794-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-795-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-801-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-800-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-799-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-798-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-797-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-796-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-766-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-767-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-764-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-762-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-760-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-761-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-759-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-758-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-757-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-756-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-747-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-749-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-754-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-755-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-752-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-750-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-751-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-748-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-746-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-743-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-745-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-744-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-742-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-741-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download

memory/4152-740-0x000001A3CF600000-0x000001A3CF610000-memory.dmp

Download