0795f2e2a0305d6311e25114edae8b893a77700ef12e0c36b85dceca3cb3e51f

Resubmissions

02/10/2026, 12:07

261002-paembszhlf6

02/10/2026, 06:06

261002-gtvhws1bkc5

Analysis

user interaction
yes
max time kernel
871s
max time network
1378s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/10/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FeedbackStudy.exe
Size 393.9MB
Sample261002-paembszhlf
SHA256 0795f2e2a0305d6311e25114edae8b893a77700ef12e0c36b85dceca3cb3e51f
MD5 967aaeb1145472a958851d142268977c
SHA1 c9ab2f3de24e31e19b4322f0aeae2a8067bd60cf
SHA512 1757368d2522aa1e27ce7783916cb8ec83a79afcda2e45cefa6f04eacecc0c941d21dd4359d1106d79ba22862330c002c2a52cc04f4c2a474b5f487e0a479b60
SSDEEP 6291456:mpv9AajeWsinj5PZResTHUu2rN5ZNf5RG3VJJn3UN:WeWJkgU1rN5ZNf/uXJ
TLSH
T1481933376B442D8DD95542BA21B3CDE66BE16DAD0C9B47071E4F239B3E722481F07A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 54 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:\	chrome.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	chrome.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	chrome.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:\	chrome.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	chrome.exe
	\??\D:\	chrome.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 4916	4904	FeedbackStudy.exe	83

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4832	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	FeedbackStudy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	FeedbackStudy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	FeedbackStudy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	FeedbackStudy.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042c7dfbd6a52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab04fdbe6a52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000118f26ab6a52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c52d0bd6a52dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000a3e3bd6a52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\6	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000484f312a1742dd01f69547612142dd016f6ad0736a52dd0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{25CC242B-9A7C-4F51-80E0-7A2928FEBE42}\GroupView = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000060000000500000001000000040000000300000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{25CC242B-9A7C-4F51-80E0-7A2928FEBE42}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000f000000002d5cdd59c2e1b10939708002b2cf9ae02000000f00000000e9fde5ce41d534496a956e8832efa3d02000000f0000000a66a63283d95d211b5d600c04fd918d004000000f0000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{25CC242B-9A7C-4F51-80E0-7A2928FEBE42}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5 = 14001f80cb859f6720028040b29b5540cc05aab60000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{E053A11A-DCED-4515-8C4E-D51BA917517B}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c000000500000004c58e0e388b75a4abb207f5a44c9acdd0600000078000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000ed30bdda43008947a7f8d013a47366226400000078000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 050000000100000004000000030000000200000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\6 = b7021f003d02d5dfa3232f020400000000002b0200003153505305d5cdd59c2e1b10939708002b2cf9ae6301000012000000004100750074006f004c006900730074000000420000001e000000700072006f0070003400320039003400390036003700320039003500000000001c010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000160014001f80cb859f6720028040b29b5540cc05aab60000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000001aa153e0eddc15458c4ed51ba917517bffffffffffffffffffffffff00000000010000001e00530065006100720063006800200052006500730075006c0074007300200069006e00200051007500690063006b002000610063006300650073007300000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000014000000434bf82b180000007300000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f00000020000000530065006100720063006800200052006500730075006c0074007300200069006e00200051007500690063006b0020006100630063006500730073003000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe000000200000000000000000000000000000000000000000000000000100000063022a0000001900efbe1aa153e0eddc15458c4ed51ba917517be13d2485fb372a48a7b6b6bdea33c6b863020000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{E053A11A-DCED-4515-8C4E-D51BA917517B}\Mode = "8"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{E053A11A-DCED-4515-8C4E-D51BA917517B}\FFlags = "18874433"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewVersion = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4 = 14001f580d1a2cf021be504388b07367fc96ef3c0000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{E053A11A-DCED-4515-8C4E-D51BA917517B}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{E053A11A-DCED-4515-8C4E-D51BA917517B}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000600000005000000010000000400000000000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000004000000030000000200000000000000ffffffff	chrome.exe
Key created	\Registry\User\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\NotificationData	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_FolderType = "{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{E053A11A-DCED-4515-8C4E-D51BA917517B}\Sort = 0000000000000000000000000000000003000000901c6949177e1a10a91c08002b2ecda903000000ffffffff30f125b7ef471a10a5f102608c9eebac0e000000ffffffff30f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{E053A11A-DCED-4515-8C4E-D51BA917517B}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\IconSize = "32"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4904	FeedbackStudy.exe
4904	FeedbackStudy.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
576	chrome.exe
576	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
632	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2272	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2272	AUDIODG.EXE
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4904	FeedbackStudy.exe
1824	firefox.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe
632	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 4904 wrote to memory of 4916	4904	FeedbackStudy.exe	83
PID 3020 wrote to memory of 1824	3020	firefox.exe	89
PID 3020 wrote to memory of 1824	3020	firefox.exe	89
PID 1824 wrote to memory of 1044	1824	firefox.exe	90
PID 1824 wrote to memory of 1044	1824	firefox.exe	90
PID 1824 wrote to memory of 1044	1824	firefox.exe	90
PID 1824 wrote to memory of 440	1824	firefox.exe	91
PID 1824 wrote to memory of 440	1824	firefox.exe	91
PID 1824 wrote to memory of 440	1824	firefox.exe	91
PID 1824 wrote to memory of 440	1824	firefox.exe	91
PID 1824 wrote to memory of 3896	1824	firefox.exe	92
PID 1824 wrote to memory of 3896	1824	firefox.exe	92
PID 1824 wrote to memory of 3896	1824	firefox.exe	92
PID 1824 wrote to memory of 3896	1824	firefox.exe	92
PID 1824 wrote to memory of 3712	1824	firefox.exe	93
PID 1824 wrote to memory of 3712	1824	firefox.exe	93
PID 1824 wrote to memory of 3712	1824	firefox.exe	93
PID 1824 wrote to memory of 4040	1824	firefox.exe	94
PID 1824 wrote to memory of 4040	1824	firefox.exe	94
PID 1824 wrote to memory of 4040	1824	firefox.exe	94
PID 1824 wrote to memory of 4040	1824	firefox.exe	94
PID 1824 wrote to memory of 3600	1824	firefox.exe	95
PID 1824 wrote to memory of 3600	1824	firefox.exe	95
PID 1824 wrote to memory of 3600	1824	firefox.exe	95
PID 1824 wrote to memory of 3600	1824	firefox.exe	95
PID 1824 wrote to memory of 3636	1824	firefox.exe	96
PID 1824 wrote to memory of 3636	1824	firefox.exe	96
PID 1824 wrote to memory of 3636	1824	firefox.exe	96
PID 1824 wrote to memory of 3636	1824	firefox.exe	96
PID 1824 wrote to memory of 3800	1824	firefox.exe	97
PID 1824 wrote to memory of 3800	1824	firefox.exe	97
PID 1824 wrote to memory of 3800	1824	firefox.exe	97
PID 1824 wrote to memory of 3800	1824	firefox.exe	97
PID 1824 wrote to memory of 4180	1824	firefox.exe	98
PID 1824 wrote to memory of 4180	1824	firefox.exe	98
PID 1824 wrote to memory of 4180	1824	firefox.exe	98
PID 1824 wrote to memory of 4180	1824	firefox.exe	98
PID 4108 wrote to memory of 2356	4108	chrome.exe	100
PID 4108 wrote to memory of 4832	4108	chrome.exe	101
PID 4108 wrote to memory of 2312	4108	chrome.exe	102
PID 4108 wrote to memory of 2312	4108	chrome.exe	102
PID 4108 wrote to memory of 892	4108	chrome.exe	103
PID 4108 wrote to memory of 892	4108	chrome.exe	103
PID 4108 wrote to memory of 4600	4108	chrome.exe	105
PID 4108 wrote to memory of 3432	4108	chrome.exe	106
PID 4108 wrote to memory of 4600	4108	chrome.exe	105
PID 4108 wrote to memory of 3432	4108	chrome.exe	106
PID 4108 wrote to memory of 840	4108	chrome.exe	108
PID 4108 wrote to memory of 840	4108	chrome.exe	108
PID 4108 wrote to memory of 3220	4108	chrome.exe	109
PID 4108 wrote to memory of 2224	4108	chrome.exe	112
PID 4108 wrote to memory of 2224	4108	chrome.exe	112
PID 4108 wrote to memory of 2912	4108	chrome.exe	113
PID 4108 wrote to memory of 2912	4108	chrome.exe	113
PID 4108 wrote to memory of 3592	4108	chrome.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FeedbackStudy.exe
"C:\Users\Admin\AppData\Local\Temp\FeedbackStudy.exe"
1⤵
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- \??\c:\Windows\hh.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 4904 7081984
  2⤵
  PID:4916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {a1a37b27-631c-49e1-b6e6-4deeaca2b990} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {1fcfce85-00fb-4509-8ab6-f10a3e04552f} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3688 -prefsLen 27323 -prefMapHandle 3692 -prefMapSize 270279 -jsInitHandle 3696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3704 -initialChannelId {097a1fbc-9eda-4253-94fe-cf78ac4e2f64} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27323 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 3872 -initialChannelId {af28ed27-dd44-4f18-a569-2d1506ea058d} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2920 -prefsLen 34822 -prefMapHandle 3212 -prefMapSize 270279 -jsInitHandle 3216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3264 -initialChannelId {b45a97d8-7bcf-4577-9068-2c4eb0e1aef2} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 34876 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 1376 -initialChannelId {dd3747b7-31f2-4621-8ecb-4f4772304e6a} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32900 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {d622d26b-5893-488d-92eb-58560d4d534c} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {80b67c41-d73b-4ae5-b5a2-6d1f52f9a056} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32900 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {c8f100d6-f38c-42c1-a385-093ec7c4534d} -parentPid 1824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8adf7c728,0x7ff8adf7c734,0x7ff8adf7c740
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,14554006969291579770,14669388970874504575,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,9647812307026619815,14618990387828961318,262144 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,6244613097287247032,17651228073352496155,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2472 /prefetch:13
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,8642537628519864077,10276012814589330409,2097152 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,13373672465423334971,4585435044045145013,2097152 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,9360712930448200728,18030559827105691535,2097152 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,793408258188806998,14113761782124168903,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5712,i,12000398582482342687,15473351524976042703,2097152 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3420,i,13401994144984094579,6154336592662958402,2097152 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5912,i,5665079694860653843,8926763777198232311,2097152 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4708,i,4372127817933583618,16054859903184899141,2097152 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,4647850632587070915,8125370700306000211,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4440 /prefetch:14
  2⤵
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,4590202898555488561,8189791808921792292,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,5161442706548787651,1869550563299959381,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,13658342962599317574,43227020181219564,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5044,i,7800316035986919755,399729713067630043,262144 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6092 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,17382384645732365732,11730098073267176104,524288 --field-trial-handle=2072,i,14771146607236604718,16601774985344744834,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1516 /prefetch:14
  2⤵
  PID:3016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
PID:1196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1300
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2288 2728 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1016
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2756 2752 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:3608

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
PID:5116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\9a0be6f91b8dcf94\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 ca8398ff069d4a03a10f3d79ba1d3f7f6b3b90eb0360c730174ee4ac73ad3f50
MD5 6c370584ac2b493d8004a755c6eed87b
SHA1 174ccab81b28393588b1614bf62854437b3b2f05
SHA512 4c5e50abfb94f1e5a96d60792522bb8fb376d23a1ca1e9c7c3a1407844cfe622627a214219767948887892444a6fc4f7325c7070e3a1a4857b690649a55780d6
SSDEEP 3:S/lGlll/l/lXp9ZjrPBY0HPJwjP:S/0dPBY0vJU
TLSH
T10253128121920127C812037204C606507A752104038B0C1152244234C89878508A0281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\9a0be6f91b8dcf94\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\9a0be6f91b8dcf94\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 992B
SHA256 e807aa12a4f5998ff5b43646493d96c909baa94a5bec11fb10ab6ed4256cafb4
MD5 8a346db538e77f171812a1b0418b4317
SHA1 7579e5c2a1af2f56d2a0c970a49b1c2f9fb58af0
SHA512 0f3f4d1f9d2639f3a12219519b202bc424b1620fd071a52c5007cea8d04cd3b0609671d46656d13cc05c371a2bff9963ff655ed921682faad18dad5978075079
TLSH
T107118C80B6E62DB0E3BBB97045BBA16827BA781258C1A10C4088C40A4E31A1C9A22F58
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
SSDEEP 3:i/lGlll/l/lXp9ZjrPBY0HlA/H7stlDP:y0dPBY08kJ
TLSH
T1A35312405643025BC442033048CB87D43934A5048383009143708130C49930004701C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1008B
SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
MD5 d222b77a61527f2c177b0869e7babc24
SHA1 3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA512 d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
TLSH
T182111291B7F61DB0F3937170687A7B60173BF1130585624D80C491188D724088815FB7
MD5 SHA1 SHA512 TLSH

Submit Download

25176a30-bc73-4f40-8557-2f830a6c03ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\25176a30-bc73-4f40-8557-2f830a6c03ab.tmp
Size 264KB
SHA256 1d430cbd936c0f75706f9b147039fac56a459af127676847e724dfc1a6e558d8
MD5 af7c68d5f6dec688e6ece76970398a9f
SHA1 519396dfaed03a1c3fa265af3d80d4e0f24d9b2e
SHA512 ae787916cfbe69be99cf0672da3e3d467488c79d44f421dda59158cb36ec350831830a36e3aab379cf962dbaf4105ca2386c561097f32bafefdeec771b08bd9d
SSDEEP 6144:dJdaRmVrMQDUiSJhavF31Fz22ZuzAMQjmvaFezXEmLOMzex0:dTa2rMQk4FFFDQn2FezpOxx0
TLSH
T199442371B9AFDC57D2347429F839BF853CD0F2EA11C163AF988056EE8917AE80B85940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

351897c1-200b-4e63-9d57-1b3a18902fd5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\351897c1-200b-4e63-9d57-1b3a18902fd5.tmp
Size 264KB
SHA256 67416f743e7675ec7385d45a9d33419f59bb27bff7249ed761e00f1238a9e46f
MD5 338ae9b902a0a968a08c82dfedc1c8fd
SHA1 09a9330a9750252b62d2db20fade68d06e76abba
SHA512 50642b6059d1bb97d9b0c0098ac0f76f6f33991fa06dd97c58fbd7d1a3f07c059ba50e1488c2035808f172ef2c3584636a8390542755cc9f7f3435247866607b
SSDEEP 6144:y0JdaRmVrMQDUiSJhavF31Fz22ZuzAMQjmvaFezXEmLOMzex0:y0Ta2rMQk4FFFDQn2FezpOxx0
TLSH
T1E3442371F9AF9C57E2347429F939BF863CD0F2EA11C153AF984056EEC917AE80B85940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ce65679-56af-47a4-a12e-ffa48d399008.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4ce65679-56af-47a4-a12e-ffa48d399008.tmp
Size 264KB
SHA256 8bd71b6fc150808de057b3e575d82875666fe9ebf22cb3c5c590ede0cca3e53a
MD5 4097b553364ae63b471c47a436716731
SHA1 005034432ed4446a39208fc0dd07222528182a00
SHA512 49868c9379b89f420f9116243908c3b4f17ac04713f00021b5d5ea48f499dcb25c0010106d222f80c60bbb549c470ffccde8f5d17a4eed2942e7a10959bfb893
SSDEEP 6144:30JdaRmVrMQDUiSJhavF31Fz22ZuzAMQjmvaFezXEmLOMzex0:30Ta2rMQk4FFFDQn2FezpOxx0
TLSH
T130442371F9AF9C57E2347429F939BF863CD0F2EA11C153AF984056EEC917AE80B85940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

988cc1ec-c216-4ec8-8994-5126b2612694.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\988cc1ec-c216-4ec8-8994-5126b2612694.tmp
Size 130KB
SHA256 345cac08cab68a9bffe44e5fef672a2424cc874b0de580972f5754dc2345c88c
MD5 a38828f8cb23fc72571519e406a9f8fa
SHA1 6d34e198524528111664c5bf87e539b7fc144e78
SHA512 e48972744548686d6392303a157697087bf852cc90984924a2d041cad186deb3492aa392c1f013d563a269c8233798b1b7babd72a786892d47deb03f47a2bb7f
SSDEEP 3072:N9Kif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:GzAMQjmvaFezXEmLOMzexY
TLSH
T16FD312B4657EDCAEE334E51EF9D95B463DA175E724D463EE3880A2CD88B37E801C0590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 757416f1f760b1ceed0c0c97da8329c775c0b7aca763179d35fe3740cba4d91f
MD5 ec1f47ccb801a86f9cec3a336226ea17
SHA1 099a56b20d39c82124d622ff00967bcc3e207641
SHA512 fc5cf9fdb73889b49bd800287397fb5b0d2c3f4af0e896e8eb495a263a5e2ae3ac7a7d3a88a720dd1140fd4c9863a5a0d562b47e9cd1ed45de10bad8a67db9aa
MD5 SHA1 SHA512

Submit Download

0f4e3177-c1b6-4229-b4c4-4ac9283bb702.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0f4e3177-c1b6-4229-b4c4-4ac9283bb702.tmp
Size 649B
SHA256 62d8cfda45a281a0e268b2ce7a83c36edd8355033fa6868110ee1a5cdbc24854
MD5 dda352b2015716a788761ea0ea1e99de
SHA1 6efd0f20aa17d0b95366a7452af9fb53bb1351ce
SHA512 939506a8791d7d365079554e38d447d03ba7091b1c3e516bc2eb099fb1c53334f204e96aa3344bf7fd61d9d67e6e6b245894ded5a87e9fba9d1545f1f2daaed1
TLSH
T1CCF028A6D920BC3708FC4BA960A9478AF79113573780999F3A3DC11D8F7163B869585C
MD5 SHA1 SHA512 TLSH

Submit Download

270b9269-eb24-4c0f-94e8-487d5c394540.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\270b9269-eb24-4c0f-94e8-487d5c394540.tmp
Size 13KB
SHA256 2cf7d23a65abde323c9908de2ff75956c38e703e58701cc03b1b5c9f2d4473d3
MD5 f3530a5ec8265cc8a90b425103cc3d28
SHA1 d634b11989bead508907c51efd8b33937a70372a
SHA512 30d09ca1d9c752c9b8c8bc5a854390e0b57950ad7b2dcfdce3475ab37b02305f7f29d7e4a9a77b1b68fa63a9588f19f9c545fc4955c36375d91af268ac996852
SSDEEP 192:hRvcBz5o5Mv74p1PRpp9Cr5s93Hsb+WNFTIH4XU2N3edi+AVyIsnAUgrat:hRvmz5EYUvXXxwGr2JtG
TLSH
T18052A52AA810797B9DDBD2ABF961FB57E3F5202160D42E84E6FCC92C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

295c6dd0-8ff5-4664-9049-36b9bd025518.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\295c6dd0-8ff5-4664-9049-36b9bd025518.tmp
Size 13KB
SHA256 4293a59890851f6e157ab8ae5d1bcfa32e9c8e86e8820ca8d97edd39c0eec14e
MD5 b095f945ef2cce789e3b6347a243c8c7
SHA1 4a4e9f541ff9bc315232762b75c0554dd9ab5597
SHA512 e652c40c29006b441d70aa4fe7cbf2019aef78d8b1d5ca8939ccdca76e9a3ae2e108e46ac265424f91fc8f6b7b0f472a69308ef864ae9988ab754c2ba60e17ec
SSDEEP 384:k6jA/7KxkXqKf/pUZNCgVLH2HfgsleLXODAj+ErU3luHGCUbvTiY:kqA/7KxkXqKf/pUZNCgVLH2HfgsoTOsw
TLSH
T1E0520967688C9A3F4FC8D94CDC26BF4FACF601566168482453FA9C1903E5BDB014A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

475ba752-ae44-4270-a68e-926ae02cf62e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\475ba752-ae44-4270-a68e-926ae02cf62e.tmp
Size 13KB
SHA256 3d0300035492e51c1468737e6dcb54906ce181e2637de6c564a5083e81ce6c21
MD5 c8bc6b161cf6ddb184d1a073b36e048b
SHA1 af3c1a1e0802179f045f4a8ade889f29191a564b
SHA512 4778428bd95cb815546ce86bb754eda28704563cd24b52e343428355c826b6ff5d16f98328cff026f5c26206f4d8bf863cb9a271c67063c59d9bf8e2b480fcf3
SSDEEP 192:hRwcBz5o5Mv74p1PRpp9Cr5s93H/DHsb+WNFTIH4XU0gb2G3edi+AVyIsnAUgrat:hRwmz5EYUvXXNrwGr32qtG
TLSH
T1E952A52AA810797B9DDBD2ABF961FB5BE3F5202160D42E88E6FCC92C14D75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bd8d801-03a1-494a-83eb-d1540cb39cc7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4bd8d801-03a1-494a-83eb-d1540cb39cc7.tmp
Size 13KB
SHA256 953c47db67fc50d957afa94882bccff4183f92eec55f52e3b9f7f17f72d2d582
MD5 d7454cbbcc3acdb81a6fa27c50ce8e6d
SHA1 8cb42dfdf0ba4b06e2aab26755583dd7330622c2
SHA512 53980e29cc21bce72da40a3deb67fbd5fb1d7717172c15722a45e704d9e450ce08f3f31d846f6ddf02d112c8a4ca45d294a76289ec3728fa310ea92b12caca94
SSDEEP 192:hRvcBz575Mv74p1PRpp9Cr5s93Hsb+WNFTIH4XU2N3edi+AVyIsnAUgraJ:hRvmz5lYUvXXxwGr2Jte
TLSH
T1DE52B62AB810797B9DDBD2ABF961FB5BE2F5202160D42E84E6FCC92C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8b3c322484843317cac384aa8736af61e17e285cd41da23ac416fe8d8a49652c
MD5 fd6fcf37724dc3b9b9adfaaa1cb57131
SHA1 7d999481de768d16445e692a67c45366db4e2513
SHA512 9220547be91f431f3722683a71cc5dd11de1b18eca7b8d4b32979d602c0618597cd81c9d2d993205322988ab7ad6f024ffae6d6910529a4dda76b34f45702311
SSDEEP 96:2HyRc2wK5xJ35mV7NtpHAssb/D+2xBEO9HbEq:reK5TpXb7fxBEO977
TLSH
T1A31372BD8BA05E2EE6EB493D4893173A67F80A07E4E6C42B40BE7D5531603DB680F11D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 612e5c33c51fab30205452171f52ce18e4712656aee4539f6f69f1933a7ad1f9
MD5 d092f8f380c3a9b9826069f06496a7fe
SHA1 a6c82327c40b7df2f4297d8611b712a41d1948c2
SHA512 ce73f8a0d7970a1e30c3e383b04a1195892fc9c356e5637148ee9085cfe489e88305afb73628d23ea146a5639f99ad07114ea4d5423fe20200952f832084884e
SSDEEP 768:0ZkICWWSsMq2SRajL4e8Z4Fdzvj5HToJverW2:0ZkIQyk2Fd/iJv
TLSH
T1004450F71005BCAEDB358AF0A145F53C9D7B051BBEDEC8CCE99456F111E1AAAC6348A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 6e0eeb5869beec1e17442b8d45308f24cd0b8d8b83f87c357ec4de5c8bb46f6f
MD5 c41f7e64b81c9bbe964e1a874eace096
SHA1 fd95b870735b29b442c30e8c9cfd0c72633f3856
SHA512 5174a78da70d24be2296565823942dccda2f52b0458ff416afc03fc54faf218e077d1bf412ae56797ee052379a56b18d02d773a56f7b7b41a5a8f250c418fd13
SSDEEP 1536:+vIGg1o3phGF+dACA4RczG4ZJPMTGbOWGcaJgVhPAyVsCF9hAQR:HR1epY1bWg/HbUcaJgIy+CPh3
TLSH
T19F25CF3311865E55FBB6D6F0209EAF593FB9E80F2785E22D339C17F1A4E0819C251AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 437fd2708ecb5e69e878c99bcb5ecc1eb1da5aa2efa90779f1e0649919d813fd
MD5 c10c98839dedba63c2c560718bb76cff
SHA1 1edbc2388501bbdf0d014f9b85899ae3280fab23
SHA512 8f78522091933c8619b4a6b7b819d439647687ca9fc00b1393fc9611f1b73ed198b902ea2ebdeededab486d149003f7c06afe62975c44cbeb434e4b158831acb
SSDEEP 12288:PV5o4hxjiTUubQE4PuC0c7yojnbxbsEMjDMXXuG8E7d6CZ2WwSsxlEHvOsg6jY11:Re7BUf7Y
TLSH
T17A16A0A74F78A942E681DE70BBCDEC2C7DB072D2FCCA5492A512C27984E1FD41B8505E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 3cd52b27b9a59da18452ddeb8408ce88a39cbdb6d146f39781548611ffde02ad
MD5 17e2e884df8f9c95954b1c0bf94b2585
SHA1 2abd01764d1f1ace0e7350f468fcd63ced7fc01f
SHA512 da2d2357f757279c57afc8612a15a8214292656dc98f68164531a934246110fdf9ed207c97a2705307e7db19f3dae314fd1cbd383d49c092e8a796887ee8dadb
SSDEEP 768:IIwSSrKAO2lo0gFDjO/RwxC7SkybYPcqjEs8sVVQpbFOr7nWn5Db1T:IIwJzqxjO5P5qYPljB7Qpb5nNb1T
TLSH
T16203F1E829CA6A05331284628D47DF279195DCECD7FAFC8E86CC07C84EF9675126268D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 73KB
SHA256 f3da3acb05ffefdc9ae669d4d171476ad2d7f4aefefa8fa9e0245a7a3b5ac2dd
MD5 9a896a1d99d04ee0f3fd1b7983fdf1b7
SHA1 a8e793d6fcdf858eceb9f42a9f75665d6a92abc0
SHA512 227c7027b7c944a7472f41c28056bad40b0d3116a3ea88fd350cd9f3c1a44f36d475ae8fee82b558619be48bf78982da14e87617a7a4e7a2241b94ab8272ef8a
SSDEEP 1536:O77BHwf0DFsAQtr1cHixbkJJqPrfkqrFDMllDv4nhz7y4vj:O779wTAwr1wGYJJkfDMXAnhny4b
TLSH
T1887302F82C92C0851875371B2FCEEC37990BBCE11295CE64368DF065D6B7A1B8E16D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 45KB
SHA256 e1358f81eedd3b81331f928ccbf8493e340c2b4d0b217dbdd9ed6985d1b4b3a8
MD5 107ea7910d6358389d61c0f2e8a7709c
SHA1 c5bb9d75e9b2e339c5af4661a4df022cf46be00e
SHA512 9a2c67f1d0696bce814c11e53fa1e0b5bdb2530c2fc3eee07146ff501704dbd9c39f1bab9edad0b0396f925ab7a5d0895a8f6c54df4e64f5f3801111c9a1f853
SSDEEP 768:NiwPuTap1cDuhUMo8pnYAildjbnthgAYg1YTkp3gRLq4LB+iheGxPpLwmt1f5:NUTVD0dpYTNb70tTkdgRtxfhXt15
TLSH
T10223F193FA761D992899F16DCF12B5C84C98DE400A1B61BDC86A78CF741614B743C2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 233KB
SHA256 00a66f83882a7b7e9067f49aac1b0568d6452d0ca1b11267dbfe02e1251aebcd
MD5 341b5cbf5d9c6b6112c207a6387276b9
SHA1 9b4c5b12d6653d557aa3fb1436353115382741a8
SHA512 f3b073f3af523cf3dd6443ac1d7a57c95afba7151d1050d9aaa412ce3782476ccc56ec9d1095d709079ec339ae2a21664178576e194d826fb79e04009129c470
SSDEEP 6144:xy+tiGAkirzw1pBkl/65vwnmn7Gg1bRjwmJWW9Fi:xy+thkfWZ5zHri
TLSH
T13F3423F2B214BC9505B7CACAA54EF6B2EB4C261A8FD6B6845DAD05F239F9707704340C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 88KB
SHA256 233bbaf591c2daa1003b79a816fc6e23315e2087e04796482b2c862e44f1506a
MD5 26b4ac88375fbac7219351532bfdd790
SHA1 911d9a3028ae3984ebbe6792890d6e4f987d9a23
SHA512 4560a3bd7e728ee7674e2d70d4b2c54ea79443aeb576036320a26a4404bfa2dd10bf0348bccced814e0db5acdd0c53bdaa1632ff93fc8a8f0c87b5420726919f
SSDEEP 1536:t+OC/plzLOeu9aIE3RZmsstHt7gYRDkEUii0WYteXM43oYEY:t+PzLU9a3Rpc9qEUiCX1YYEY
TLSH
T15E9312C2C5FE29A087477C55A1BA2AC2CEB0153285F6F3CD33CFA54A82AD4C4DE45E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 518KB
SHA256 eb31a67cfa564906da0e24ebc5afa814633d3978d17bde44addf125ea9cdd597
MD5 2e72256b09d410ef206575aa1e84a94d
SHA1 1e4cfc7ec67224bdae86a8c482ab2412c702ccae
SHA512 d748c34bef4c3b6c87c60f9fcbb1752cf4491111eeedaca7ec53ab42ac3309a8f1e7043b47135f7caf0672483ae7ae1e219fcded073b5083dc5eea3c990beb73
SSDEEP 12288:jbctNs2n/MdJPvcpsCYZ0ujswjTcYRvv7V0rdqlsJbrg/:yNf8V/CYFBx7qrdVbrg/
TLSH
T175B42330A68CE77812CCE6A9059BD4F365570B6E2DB7F5BCD349C467289930827780BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 55KB
SHA256 bfb9fab5b77b0e6615c845a7f669cc6d94448a31e4e41b58f51aa9fac519f241
MD5 205db06c3964d32c08a810047157654b
SHA1 2d08f00fdd89b28882dc9b0bf1a5dcab1f785cfe
SHA512 070b698d1e1ebdc8e89b64f24ab4bef83ccbc06cd31b23359b29ea1f40f50af6eae254e11a32309e6c13a5d9ac49c65c8afc629d193688937324cf45c154afbe
SSDEEP 1536:ytawLKSIDORfTI/uejDT8lpGoW2+mK6ypWXsUQtxCtT:oafDORfU/9TGUqGtUQnCtT
TLSH
T16043020053C51F79073E6E771234AF7D27816CAA5C6B5086023FAC6FF3E6D689D94126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 66KB
SHA256 85889c1e44920a26f3830b737e5610db3c7c81db72e3de550e5c6ea0256c7fe4
MD5 585d9b95746ce51916b942edc454e25d
SHA1 ccfafc1140c542f529ce5ca6a1182d6d90b0631d
SHA512 cd1e0c52142044a49490cc08b1fe259d026c1dd8c51fd6c0d2ca716e3be63cdcfbb23ab7e2b76e7ff1e1ddb1eb452774fa71e0851da862fb8f947226789fbd2a
SSDEEP 1536:UNHtPWaXQA21Q3HeEjVAs9LmY7PCJ9WJna51X3i6nGQXs4+:KN7H3jZP7PCJmnGzn/st
TLSH
T178631261ED0D36B9C4259CB936A6C20C2EBE2088235BDB5EF509DB875703C2C4BE59F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 49KB
SHA256 68fa6c4b585f431ae3089feed7b6f6deea496528dc385faa3c5253f770bddc83
MD5 3271d34e3c7c60d94beccca045054e03
SHA1 7ae6de597995169b6d127511af9ae809e2512173
SHA512 181c3d289ee99f229f3d21ceacd73d05dbcfe119010c614435723b54397e842796b3f2f16a21a14712a6b25882357efd577262ad4cf3f460876dede2c6abba26
SSDEEP 768:HVo+zbY4h0SLM9iIc+0DyVkjM7j6Uw1DlUrn/Duv7F7Pbe+rRaq8Ms0ulXdP/u:C+z330cxDyUMS1DyChS+rROMvWXFu
TLSH
T13F33F1DF694F45B1C36798CBC40F64E05999862D08A1E239E5D3E998DBF12BC06E8CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 52KB
SHA256 586bc10ad31307fbea8bde0640a70756c17e16b0d6ea3f9b9ca854eb521c684f
MD5 df0989f0d70bcc5d5da13104b5daf381
SHA1 703d2ec63f6593e9460fdf99ee180804207eedbb
SHA512 632ff7f5773b5702bfe1982c23519369e95608c77d8f2785aeb4e71f3322d9272da54ed87a2822dc89ef24b854c9bb764624932e07a0279af288f52c31b69bcd
SSDEEP 768:MBgMPkjxRaJwbsglfiAzptKqVwTG8BI9cF3m5zG02LKmXBQgFf1KOvEX:M1P2aal8AbKqWTFgW3ZF/WetMX
TLSH
T16D3302FBAC4C8541EE3B825ED402650DD9390172A10BF7A3DE2E4882F51BBA3D953770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 123KB
SHA256 2ed8f151791bb6da09d8e8e85c936315b68d7324bfb597a4d9dc3346360b86a8
MD5 98f6abe32b3eaf5b17028ef79ef74db3
SHA1 1f70958a0c741c448d0f48bdd0056ba6e53ecbe1
SHA512 d70c0c07d9110eee2f5a92da21f2b656ed9938ce47021091ea36011b247627f2fc7238381099dd1c565913e1c851f17cb125d8be7b73e9674b431a16c33838da
SSDEEP 3072:hyXUNUWEoOL/A+r0gTp49Z20n2ElcCs8lO:hpeX02piw02EDs8lO
TLSH
T121C312FB3F0832013EEAE65529CA57BE6C6465F2F8A30A18116456530EFC62BD5DD23C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 073f5761955ad8a31988e29fbc320191c65462b46fba33f838be611942248828
MD5 e79bc2f3d9ade8cbf45b835c07612820
SHA1 dadc294c1dc794effda1cf2313e771cc2547788e
SHA512 660186d06c38f405d60e6253370d39bd434585d539a4009b381e6590190ccbef567fbf62a105202aac54b99fdaebd272f591c1a990b04f5db368154a216a2c73
TLSH
T17A31EC15E8803D2CCF441537CBDA5948F4E2E427D22BEF43800E34B47CAE3A2499478E
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 80KB
SHA256 b08459a9cb71828f0f8004b0a09cc631a208af1ecd3d343406e7378c2f204761
MD5 825f510b46beabfab1125c4c5dd2e602
SHA1 9d97277ab2bffba077aa2e14b298edba3f4a0452
SHA512 a5d960f2d508a796ae2df73d6a603d4d3e20b321205a76bdf0c386ca3e56830f21fa673285b7311b87e78fdaf27d366143819b3ff7fd8ee01e8d757982922d49
SSDEEP 24:KE2Ri8Tz6AwHKInjg3Cg1r4pxYmL467Al7xNwmf4xbkB4P:k2jHKajg3bUpxYm068l7kDNkqP
TLSH
T11A83E1E76634F233E7008039A1D7C6E858302676D56DE8AB7A5EB4B14D83E4847E74F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 28KB
SHA256 d7ed6afa18316ffd9bf8fb02003fe1ed5b44673453f3c9fece4799a494016b5c
MD5 78840a3e753ea768be55788dbe1e1ea9
SHA1 0c7534e2487f16040f3dd5d2c176c040aa1b05a4
SHA512 9163c92ec7cbadf94c4ad259eb81356c0c8dfc78b351527ffc8261668c5c8ed77178f5e2338a2b57a59fd9b152adc7b52f17e998d1bb4fe8c6b91b5f7991f3e5
SSDEEP 96:EeBCP7G601Q8K89x148f89Q3iepQRIadfwWanVdJUAEYOPA1+bXbFuL:EcJ6Z8K89Y8f89cQRbazJUAlOPA1+bX
TLSH
T1AAD21AEB6A38BD23DF168AFA3136D424DE77816FDE1AACE0B45444710CF4A860439379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 6de859f63b2fa827b488a45be4f2b257d9acb3b1f202f7971cca3f33379289b0
MD5 9bb6d0b75ef46d79ede5bd0d94befe4b
SHA1 5937e1ec81f677e9c1eb0d44b2f640756126ce25
SHA512 425f411f7ad7104b3467d1f05de4ab2612205e634d2500a44019325b04d055ab44babc00c7b9d15df878b073b52944925dcf08d00915bdba07bd95922e5b373c
SSDEEP 384:Gbx/tIkUI3ijVYWNkqp5eFJs5jHJphzuHD3IgrHy:Gbp64idkqTeJs5jHJphzuHD3IgrHy
TLSH
T130F3765F5E247212CFB9C2B968E2C5A68E3FE07FC70798C1AC9144B2CDD2667602C5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal
Size 8KB
SHA256 d21b6ffcdcf120fa3e27e8194c6e66676fc763f798511954522f179dec717c26
MD5 4e2a555c09f5f51c3b30e04aff82c0b1
SHA1 5eefd627439bc91c40bef9c3f165549025b6f4e3
SHA512 708f229f7d75f26bb3bc3f296f52e41fd2aa9e69485bc9ec7a22f6b471be840ead7bfd2ac41e6f7370bcaaca4a210aceff6c7b1c45ff9bac510c7df5180ffb0b
SSDEEP 3:Pq/3Nlljq7A/mhWJFuQ3yy7IOWUFxq/4dweytllrE9SFcTp4AGaV1vGrV9RUIdn:r75fOvxqQd0Xi99pv1eBDn
TLSH
T11C028C922AA09C73EC1C9B3DE2C381EC1F72380C8C52C8158008CC520E80DCC428CCAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
Size 52KB
SHA256 6c06061c3bac314fd607c58735ce4437331bc67d092b4712d2724cd38d6b7d83
MD5 9b382ff265371b1a893554558a860363
SHA1 fe1ec4a43b7a54b32d7246bf59af6bcdcf531ce1
SHA512 1ffd6add77737762a18f8def4f7f9038104a8fb0d66169cb54447ae1762947b80519cca50d3bb559d4c8b3b838b0a0243350066bc8913b3117ad2cb5f168ab9c
SSDEEP 96:GHCydB+M9n+8d3qAuhjspFWOwbRHtlYaqHHGUfeH3OMSkNd2n8UFUtb+e:d1JtlYaqHmxHeMSkNyxe
TLSH
T1CD3350F37912F133F81AE87CF9A8E6940D233686C895C9D8E8A00D312FD2565E12F5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15640fff-6d0b-463c-8cdc-42d316cc8789.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\15640fff-6d0b-463c-8cdc-42d316cc8789.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

2773c05d-e33b-471e-b215-f1ba61075f7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2773c05d-e33b-471e-b215-f1ba61075f7a.tmp
Size 10KB
SHA256 75eb173ce12dfcca67cff6aee2714ede811dd462ffe524f31c2ca35f1ec667df
MD5 92f74afc56e1fa496026156d267bf308
SHA1 3dff9273f96ecb8203026dc842677fc6aa25d67f
SHA512 ae8fa26ec78ba1dc4e5929012489a304c6a4e45cb39748eb203e50891ed71253d0014c59ec49b194517564eea4d2d18bda74fa2b67ce5bcc2423bbbcb9676275
SSDEEP 192:DOh1etnHGAWxq0DEywDkIEdd3ASmUmZlNP8aPAfPix1vqgHWfhV3360Zx+VG6mgW:DOh1etnHGAWxq0DEywDkIEdd3ASmUmZQ
TLSH
T141229EF7C3E4C62DC90166F59B157E1FCE290924632C3C67C9D4EE5AA3E2472E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

295443de-41d9-4eea-9843-fa7768c69d1a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\295443de-41d9-4eea-9843-fa7768c69d1a.tmp
Size 10KB
SHA256 7c0a9c2ebf12ca873d750f3dd04d8ba8fcc92612dc77a07c96b0ed3feae6294b
MD5 467f60f890f430a11eb800fe9e48e7bb
SHA1 6ba07c7e10a727aef3027cd7fb7ed47008fb9626
SHA512 928d284df39d42847b78f631e8489dd1a62334525be4140e6385eb7b3a01508ddd0774b07c1b5d6ca8cbfc25466bc58fe02c8cc937672dd1eee2e56e1f54c4b8
SSDEEP 192:DOh1HetnHGAWxq0DUxDkIEdd3ASmUmZlNP8aPAfPix1vqgHWfhV3360Zx+VG6mSC:DOh1HetnHGAWxq0DUxDkIEdd3ASmUmZu
TLSH
T15122AFF7C3E4D62DC80166F59B257E1FCE290924632C3C67C9D8EE4A93E2472E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a67cbb8-8651-42f3-a82e-3766a1b9c362.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2a67cbb8-8651-42f3-a82e-3766a1b9c362.tmp
Size 12KB
SHA256 cdd14fd53275673a0cc2e74ed6af00c687f6297c1056084748bc4085207137ae
MD5 85ac5493c03876a7a33edb9ee598e7bc
SHA1 a8f1296d72ea62251db1d030bd05256a8eb61946
SHA512 f8b2f5e9e0028af246a6261fead7ea703aa9db21196eb37e1cad54ec117945b67b209ffe2a1c05d7157eafbff57ca4359d3edc41a7efddc6696ff0c1f2dfa348
SSDEEP 384:DJTEzYeSzA0PIbowzDkYRxd3AjmAQ9lNUaYfRH5gHWfhV3560ZJUV1JfqSK1K:ibcRZs
TLSH
T11B42C2F7C3D8D63DD80126F59B257E1FCE29092862283C27C9D9EE4B67E1472E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

522c2b1a-4715-4c9e-ac08-e7503aa08b54.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\522c2b1a-4715-4c9e-ac08-e7503aa08b54.tmp
Size 10KB
SHA256 93d536b30f803d3a8aba27fbc316d2888c40f61f84007e11a87ca4044d83613a
MD5 b54e140cb11a5ef74cafeb5ab43fdadd
SHA1 9ee918da0ade034fdcdeef05f40f37160f3e7451
SHA512 84de431af7751fdc1b4a32b6a785805e235371548761598fd27b2e60f01d998451e67fa87761af03ab15cea9e93b460e809db18e4070f56ed4dd4b35313e09b3
SSDEEP 192:DOh1HetnHGAWxq0DExDkIEdd3ASmUmZlNP8aPAfPix1vqgHWfhV3360Zx+VG6mgm:DOh1HetnHGAWxq0DExDkIEdd3ASmUmZ0
TLSH
T14B229EF7C3E4C62DC90166F59B157E1FCE290924632C3C67C9D8EE5AA3E2472E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad93fee4-175c-434f-a782-ee24b5fac27b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ad93fee4-175c-434f-a782-ee24b5fac27b.tmp
Size 1KB
SHA256 73e22521e7b3f7bfe40dc16a75ab001c967d1cd8f729403d0a828462e0ce0657
MD5 9e94c8243978e8e6014c8d75b2cc5dd5
SHA1 5ec6517f7bcf321da931d650fdd6072589a73c01
SHA512 5d525d7d144fcd42997bc04cf4b4728681821e95f172c8f3c6def47ebbd4632b0149a3041dbe11f26ea4dd4af2444c462a0e05b38efecbd3c9ae289f17b74e98
TLSH
T1F3214CA7836E746720298DAB1D5478066DBAB430124264F0DBEB426C70C54E30B02437
MD5 SHA1 SHA512 TLSH

Submit Download

dc401eb9-f476-45ae-a9ed-ec63a79da008.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\dc401eb9-f476-45ae-a9ed-ec63a79da008.tmp
Size 11KB
SHA256 ba8ab4a3f603a5f7fd06d281aa3df8d70c33b50e5f11488aca3d7f5a95ef09e1
MD5 322b343eba924ed7d1c24021a04adb4f
SHA1 18a2daabbadd5674a25f07e514c265d9f93e7bf0
SHA512 2eacf97cfde1823dc23f8e4bc1da02fb1f8f6285d63ceaf1a40f589a76ca653175d46df243b3052223940b64b7b06b8bc1bea8521369ab49a472d679b3ca0a80
SSDEEP 192:DJTEzYeSzA0PIboPDkYRxd3AjmAQ9lNP8aPAfPZx1vBgHWfhV3560ZJUV1JwK:DJTEzYeSzA0PIboPDkYRxd3AjmAQ9lN7
TLSH
T16A32C1F7C3D8D62DD80166F59B257E1FCE290928622C3C27C9D9EE4B63E2472D25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 15ba06fa3844a2f4d35c9e1e08e9fc71185e62e0a1cba0436717b3ab0deb89cf
MD5 57ec1e65e590b0dad4b6611aa21dd522
SHA1 93aee732065c6369df38f9160ea881840c938ab3
SHA512 cde1ac3af33fe95bedb082504b3ac4289c542dba8486156b7e52ca44f28d805cb654f9dd0546b7c48c5639f6a54b4fb9e2efcb8b191360b7e17b8240dd0ebd40
SSDEEP 384:k6jA/7KxkXqKf/pUZNCgVLH2HfgsleLXODAj+ErU3NauHGCUb9Tiz:kqA/7KxkXqKf/pUZNCgVLH2HfgsoTOsM
TLSH
T143520867684C9A3F4FD8D94CCC16BF4FACF601976568482453FA9C0803A6BDB014A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 604a406a09b8e0e7d0ad4502d008aee91c9fa4d5dd153504e28e35df67b073d9
MD5 e67e18fc4839893dbec60ad5577e0138
SHA1 576c2e3fdc3ea460a2ce1c62c50582e031050988
SHA512 7a10508f5e8d96162d2a6ab00feb3b8d9d026743d2e16c7b6c875324051251c70b0e37ead64191ef97f2032e80eeb81438bc06621411cf517ec7adc810b2f967
TLSH
T125B01200C1A72D64D901A178260720842340CEB2C111624283E8FAFBD8471F10110100
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 b7653d7ff76c2b18f4fba63c528366ccc91220bf7863948bf171a482bcc92b6b
MD5 8dd83b6fb4d5dd2f92976c2f8b5dbd4e
SHA1 ae9ad701acb3499f8331c738c5e519993a51eb1c
SHA512 10a89d48107e1f021f253408371f006fdb38738979b1e0364b64ab4d9adb83285f59ee3815266580e068ec9b8b0e4aad85fe1d55e8ebc4495eb9e6fe8eeb34f3
TLSH
T1E6A002D102844E4DC0C51375D28301C96366AE7243C36A525195244499A95479115215
MD5 SHA1 SHA512 TLSH

Submit Download

Shortcuts

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shortcuts
Size 20KB
SHA256 2eab6505b4537e30dc501616032ab8ceff301f2af665f85b4a26f29ddf12e24e
MD5 1f7dc3fa7a33ab0d835e9a7d34ca9eb6
SHA1 d63b6a1ba07e8059e47ad6795fce00bb72fba056
SHA512 45e26575fc8a050c9de7e7d4ee300940b2f031fd8b85ad7e1383ad379843053266d0291e8b7ed97542964851616d91c0b1812bd49da4cde69a2b2388da7aa9bb
SSDEEP 24:TLeMnYLjw0JQoQlvsd6UwccNp15fBhhVpWRTyd:TKMnYg9vs8U1cvBGw
TLSH
T1FF922553BF30F021CA5A4B3E4681D6E84FB38A2D8E43FD43DDD48C296FE4580516D658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 c72aefc44440e5b48d35074bbad9327c8704ab4b45103b4e3e1cc075347cacc2
MD5 e5cef5c84b68586605013974f01716e2
SHA1 3b172eeaf419db65a4df9e79be684a9c66a3fa46
SHA512 4f808c3ec3ed1be51d2c9626d6ca2c9b26b208be140017718f53cba26d101abee60854dddb54efa900673d8d284fd2e3a38d6d34a1a8a5d5b47aeb31368d208c
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP24M4VumImEuWx:1nbZeMrv/hG5M/mTWx
TLSH
T1E1D3984B3A747002DDE58AB21CF051BB5E7CB16D4F51A5D4387620688EF2963A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9a2ef05-f8e2-48fd-affa-cf6f80f7fd23.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a9a2ef05-f8e2-48fd-affa-cf6f80f7fd23.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c172f46f-be37-4cbf-92fa-efff2d72653f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c172f46f-be37-4cbf-92fa-efff2d72653f.tmp
Size 12KB
SHA256 5a96b27b7c172177ce0b28a78cea5c59d7b5dba6de4a43143283d812abe66abe
MD5 9ebe2f94506cf1bb994b7c4cbddedd12
SHA1 4b67a8681a0fd6ed04c8ad17c67890cba8e27392
SHA512 e7db2369f2614f537ca7961a942e59d0914c85692dcceda43a4e7965d60ed9350e5163355d4109c42644167c4784e7cace4f1ee30a7818f11e00ebaab6725f2a
SSDEEP 192:hRvcBz575gv74pAPRp24rD93Hsb+WNnIH4XU2N3edi+wVyIsnAUgtaJ:hRvmz5l8UUXRxw0r2Jn8
TLSH
T19242B52EBD14797B9DDBD26AF961BB57E2F5102120943E84E6FCC82C24E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f879d2d8-5fca-4731-9390-a9b870501dc6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f879d2d8-5fca-4731-9390-a9b870501dc6.tmp
Size 12KB
SHA256 a7b6053c451ac76d669fe2519aa327569574349d8e3cee58c909e9ae33d4b77c
MD5 6d4f9f7c89409e3e570c4a30d9998c9d
SHA1 f0c2f4b19cd2556c9f5809e1c418d308d3183104
SHA512 ae90ae725cf06b56cc464987f190a1284214956dede7612993c7b66161d71504c8405db5fc80cb8591a754222b4f5fffef330874ca1195aa93ba7c7e323edbdb
SSDEEP 192:hRvcBz575Mv74pAPRp29Cr5s93Hsb+WNFTIH4XU2N3edi+wVyIsnAUgtaJ:hRvmz5lYUUX4xwGr2Jn8
TLSH
T17A42A52EB920797B9DEBD26BF961BB5BE2F5102160D42E84EAFCC82C14D75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e2802a88-f21e-4331-8f56-f59fc9f9a64a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2802a88-f21e-4331-8f56-f59fc9f9a64a.tmp
Size 265KB
SHA256 8e5800e4c946af0da1e3136176a5954d30cb7c5e6d73ed9b9f75ae3a4e7a985c
MD5 ffca2e1d4d2a2ca6946520bf3ab0031e
SHA1 208d60dff61237261f7c58a76282ada5206760c5
SHA512 8c8989880c2ad332d8968347e9103b3cbaff888c08d1f417c78a908802506124f65f47bc74f4b28853f38b63cc9d346f967d2b882686af87a710ce141689b5f5
SSDEEP 6144:C1JdaRmVrMQDUiSJhavF31Fz22ZuzAMQjmvaFezXEmLOMzex0:ITa2rMQk4FFFDQn2FezpOxx0
TLSH
T18E442371B8AF9C57D634782DF839BF463CD0F3EB15C066AEA84466DDC917AE80B85840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\activity-stream.contile.json
Size 4KB
SHA256 67653afa996d99c70e1cbeb9c857d3906a4a86729749a55adf1362fedd2e7b08
MD5 e29063ae3d1ce2dfabf9e53c01bd5b51
SHA1 b0e9face42a63e475d51a8e4323ea943f3350332
SHA512 efaefe1170c8e00d95870788396daf481ebc1abf00396120e8cacdcae365ae4d44702df169c6ec163c31ed4bea04455ec0b363e3699bf7189ddc44689c3a3ed6
SSDEEP 96:TjqMBHFmXB5D5bT+mRp0n4KYLyme6Drvolz:SMhFw5wmRp00ZewrvoF
TLSH
T1BB91A86BD5784C560771FAE19C4E3AD8F103B015D9E0CAACB17A9D1291AC3FE41CE4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 6bfbb1db8d1ac84e99e01bf2e9fc6e9b75a64f50cdfbd6558051dd9fdf72963e
MD5 aab2cd871fadb9f1309dafd9d6c57833
SHA1 0b9ce168e71427554a8a8a06073f20d0e7b2aeb7
SHA512 f0f0dcee52ff3186bedabccfcd39aae7d8f7fe4235bc4d5ae2edb4bbba52f16d5dc5d8e516fe9ccc17b8a9bce3e409858e7ddcc26481e8922aca90d78a1a6449
SSDEEP 768:bKyXE6XHgfhG7pM1xvJ52wfWPmCeQMRpJzebcUhBBTfzFQM4ePL/lJ2WC:bxlXyG1M1xB52+4M5uciLTfxL/loWC
TLSH
T1AC7319A392ADB1FB1FA577CB2C0BB55762D18196F78501C9ECEAC91C80CC754123E6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 9a12eb3649131c17905865cf1de9f9a2254752930592b8f580ad443cf45740a6
MD5 c640b948de741cad85f9701ee4723387
SHA1 38019dea60afd7c9ea6609f24b95491b1dc89706
SHA512 0497d9279c67b353df633a38a570fb3987522211c056c15143ba018d302297d6626e80d75b7d24430d5d769afe2f866ed1b76eeced2e81ae5c3b0774101db6b4
SSDEEP 768:bKyRVoRoxPvXz0zBbceRM0yKi4F+51gfDcT4OFArrPR:bxbjEbcmMcnF+ifDcT4OFAr1
TLSH
T1CD7309A396E871FB0B9537CB2C0FB95B62E1054AE34606CCFCE9C91C81DD654123E6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 c5cfb7db191c330a8f56bb807dc900cf3779e5d64613ae54f5e1e3fc8af60961
MD5 21eda0ada08459d4390cb367a6be97b0
SHA1 ff45078d3d21b0bb68fbc65ce15cf4cef341d5f6
SHA512 54658639163327cb5c6de36f941fda96a3554eb69a298ddf58d0ede20267970c2c3a0d2bbdcf326741da0cecf154af58cd78a7e086a5db04fa80a3a735b92cd9
SSDEEP 384:HalwSiO024YwWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA9L+PS+a:6l8ZYwWTToXJWTTogB7S/AmVAf+hRMkx
TLSH
T1EF728E7D8F013CAC265790E8C8B943598D1CB6A7DFF5C06D269C3E09CA84A1A71F984F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 83bdd8f347317abce905f525c8b0da880c3afa91d6263a6183efc936de1ff601
MD5 633cde05a75dbd0e7f83657e5a82a112
SHA1 2ea7fc73bd2cd8fe54c13b51a74755fa941efa11
SHA512 a7ef71c5c0e53590dd7343201f1f939beaafa9883d994c71f357c04c26040bba05d359091b9035fb9a1e70f6ff6af36193e429a2012547ee18edf7a35ff1927e
SSDEEP 3072:j3les6GbO/q3flGMgSud8MiGNWn2p90ag:peWOjMCiMiVnwK
TLSH
T182A3AEF6DFA38D3D65FFD41C6A92C93EE92A2400B3A32009D823675461C6FB47779648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 47fa7a8ce56689e6d87acfd685ba6c02c43ff0ed40ec397a7a48217c242b5da4
MD5 736abde0d614d659f4a169a77ff36d6a
SHA1 a55011af87bd3d177889f2e591f3e27602f5e3f1
SHA512 71a9542d4262a30ac40744c6dd446977a4d54a7b6163300ab6fbeae8633b9ed578a26fdb9e6044e3bd6571a1fb1c30b6df96dddcddc8c36fe9f6fdbcc59d6e6c
SSDEEP 192:zOv5zboHHZoRyjmMYR1d66Joz0dzgCl6mc0dz:cbonZoRyjqd66JozQzgC1jd
TLSH
T1F4E11D68EA28867BC414037BCCB61B414F35389A9C4E3F2935EC650C2D4A6DE778E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 69d22a496d97aa1a8a9e8945257b89fcc1e9dfb52db30e052f99312109fa87b7
MD5 5a980eb9bea65573e7c7afe3a87203b2
SHA1 3581bc705f9d6f98e913fa68d52ef4637d792e0e
SHA512 b019a4cfd8cb487c2b8b816d3babc15469c02c46f1dce7085f6834ee6b9779013f91c48a0cad76def3b0599c3409edd6e1a020d26ead80b39909ceff626bdb62
SSDEEP 192:VOv5zbo6ZoRyjqMVR1d66Joz0dzgCl6mc0d:Kbo6ZoRyjNd66JozQzgC1j
TLSH
T17FE1FD68EA28867BC414133BCCB61B404F39389A984E3F1935EC65092D5B6DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a057f775f99b89671b1ce79deaec87fabf28538bcc889567376ddb79220e55b3
MD5 c4704651d0e3e405b79daaff18df19f5
SHA1 3c2318d197ab4ddaebc538e39ae51002d86bfb52
SHA512 1201dd5ef137f1e8cf4e9256eae1d929b9878ea0feec6ed51e18f44a40e41bb449024ff4b272d0916cd271193ad5ddaccf022c24384858e23f16bd5e63d9db5a
TLSH
T16521FE4C3AB84D5A9CCBF65C7490228F57108F0B98871D430C02CF8CCC95AD932AA43E
MD5 SHA1 SHA512 TLSH

Submit Download

6c41f59b-7d25-47ab-b0b3-a662ff1de2e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\6c41f59b-7d25-47ab-b0b3-a662ff1de2e9
Size 235B
SHA256 07b0c2bcddf647c4d52d551e2c40cdbf6b5f734fa3e6a3a5c18dd0a8f6666c6d
MD5 83b50f72265ba2a1aa0e3e2e401f6310
SHA1 865d88919575c3ed93d4cec9abf8cc3c4579a16a
SHA512 cd2e48648f740229bd68c0a98278f9719ff59808496e9df1f2633841b85bafa34845f3569a22a1a6075649e789ecde6c9ceb88047e95fbf897c7506409dde812
TLSH
T18FD097C1249C6B1C09184F03B0E12EDA71844C3324719C10C5A902788AF8BC8836280B
MD5 SHA1 SHA512 TLSH

Submit Download

88cd779c-e789-4a9e-b3da-9a0caffc3c5b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\88cd779c-e789-4a9e-b3da-9a0caffc3c5b
Size 2KB
SHA256 d4f362ed91786646c8bfaaa05970118aa718a5952cfb256d2c20466685fac234
MD5 aff65924956c2019f916c5ea29a900cd
SHA1 89c1000703d845b33eb8656e7ea2f1aab63ecb46
SHA512 19ea2f43da374661f84a072a841e33f6f16d89add648559aedd821c9f10bdf90c63393bd32ff17e5b5df06504ba67185cfd0fd2dea1342cd1d8578347daf17fd
TLSH
T13E41206C75B85CB68CDBF65D8491338E53748E1300C22C932D51EF0C8E96AAE237E52A
MD5 SHA1 SHA512 TLSH

Submit Download

b77ad7c5-c146-4491-9dab-0c942d85f9af

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\b77ad7c5-c146-4491-9dab-0c942d85f9af
Size 886B
SHA256 48cce1c5d8f1efd3ae8c5fcf3555ba1b00ae97e5290ef0c61843890b234d25c0
MD5 e7a0d63a6ecca6c0dbb06e2b93635af9
SHA1 0d9e44874d987094bf2f5707e3c5e4c8bb1bb14e
SHA512 1848a83ea104fea77938e140420766b5f89e769a87d2de0f2632f06e0c8e16a2ad3ea457fe89449a9b478709891ee55ee0c65b25506eab109fe475abaa00a14e
TLSH
T15A1123505624B8B2DC38934B88F1774287F47433C4C649147DE057184DEE92F93A670F
MD5 SHA1 SHA512 TLSH

Submit Download

bfc0acfd-bedd-420c-9fff-fecfe69df7a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\bfc0acfd-bedd-420c-9fff-fecfe69df7a7
Size 235B
SHA256 a5f07497b219e9781c771f13c6285201f4c5d8ba3c2c9aec75e6ec5a5f0d9ffc
MD5 c3406db2a720f6fac84797f34cff88fd
SHA1 4367cc99aedc031e048c59e447bc5f516b745ea8
SHA512 5d440a426bfd6bec14626830299df8ec318d44bea6c2a872aed641b2f4fcce818943ac6e824cd3197626a4eeb3aaae6203088b7605e5f6317244d8d8108865ca
TLSH
T18FD097C0A8E87B6E08182F02B1A0A8C230C84C33506CA810C59148788AFDAC441A2907
MD5 SHA1 SHA512 TLSH

Submit Download

d6a8c869-e9b8-4320-b4f5-1434795f7989

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\d6a8c869-e9b8-4320-b4f5-1434795f7989
Size 16KB
SHA256 ebb6e3fa7ea97d73e87b2510c556909efa4f5690ed260666e49a44d8b3013ceb
MD5 d9392978962adcb65c54a7a35bd05436
SHA1 a2ad4c65db91b36f4ed30538e17afc72269d96d1
SHA512 bba294a07a149bca227c6a2ab485a29e022252190f4a2b514fe80b54f8b55b840c896bda240328738a7f7928d982bad7d7ccd5fd90986228071f48b5f2e75c2b
SSDEEP 192:qXFRi9bRSzCTiEtDSQ0WGY8N31yAd2Wy+V8wh1AeJzW9ZBA6e6d1LhoUc59ef:qVRi9bRS2+NQ0WLcaKsu59ef
TLSH
T10D72C956286055BA8651E368D8FCBFC3D2F538CF4C419FCA9BE4BD042DDA06E512788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da950891-8704-4941-adfd-9c2c7c7f1f2e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\datareporting\glean\pending_pings\da950891-8704-4941-adfd-9c2c7c7f1f2e
Size 883B
SHA256 e6d67bbcbdd54ac57b36098f9c7f6eb9c9ce80524cfbbc2fa9d48a3dc203c163
MD5 a85c4b4b23ce25d464049073dab09c8d
SHA1 7a76e5c6c8f2837789e0f83e75374919bccf1979
SHA512 1bca42615bfacba0d64a00c7172a3dbf1e8f47b0958a6b6f7a1d4e4f644c1849b5605200e73ffdb2d0ec005edc3bc14c90f539e22729e41dd1b4570085b1f037
TLSH
T14E110094A66074B2CC78D34FC8B5774287B4753380CA84143EF45A044DBEA1F93A620B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs.js
Size 6KB
SHA256 7529019a47524d67c3aa5af7c20d904a08d0088d7b7297babfd58fddbe3139cc
MD5 ddcf1ddc919ded17b48ad8d1f524a216
SHA1 aa27c1ba575a02936d70498113e1edaef18496ad
SHA512 7f3bd200412ee447037b0d3a8a427f703e0da6c9220af2e0c789297db9d0664b124ba7612690f8d35fd36755e42e0f24dc4e3707064494e987c9f3333340c249
SSDEEP 96:xHBUTUw3qGqYfWEr1zSBSSlldv9jSynHHwgBw88H8L4cnpVPIu:T5RYfWErkSS/wgBw88o3
TLSH
T166E1307890088B7F74B677AC6C6888315AB2413BB7BF68C750B99485051CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs.js
Size 6KB
SHA256 40d5da3740527d32244de89390d44a8c3c73bfcbbed2eb1e4fd9aa9cb0536cb7
MD5 f9bfddc887ae15bb01a9cddf1ed3dc4e
SHA1 3c3bcd41b2a44cfaaa86fb361ae7deae6f5067fa
SHA512 1e56511c316fafde6ace46d244dc7bdf67c00f3f50e1a0f7324b63c79c1b528b196d78ca743d5f54ed6d67c9313d4062d8d9f5b32ff0e495343620ee96c30f01
SSDEEP 96:xHBUTUw3qGqYfWEr1zSivSSlldv9jSynHHwgBw88H8L4cnpVPIu:T5RYfWErXvSS/wgBw88o3
TLSH
T117E1317890088F7F64B677AC6C6888315AB2413BB7BF6CC750B99485055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs.js
Size 6KB
SHA256 bbc4f6fce2bbc7b64d881275d7b205c6e85aedf983157796f5ffddd25dd6f9a8
MD5 1dc0d4912480957b93d7c3bda29e8c7e
SHA1 eb1f6fb42e527314d046ede191e136ba403d2491
SHA512 6aae04d32bf2ebe7ed65dad67257eec037358197628d24bddb15e5c77d06f6b94f834e2d0445a0de3d34fc8f4bcc0878933c3ad877ee97cf1acfa9dc8a358ebd
SSDEEP 96:xHBUTUw3qGqYfW0H1zSBSSlldv9jUnHHwgBw88H8L4cnpVPIu:T5RYfW0HkSSwwgBw88o3
TLSH
T122E1307891088B7F64B677AC6C6888316AB2413BBBBF68C750B98484055CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 b16a65a0bdbd6333f26096f6a13828718042ee1e165ddda6cdf40eab20bfb146
MD5 93f102425c8df5d69ceb6dab2eefb196
SHA1 6af86c414c74665590be7707fc9e11d4310cb984
SHA512 0a3cbeef087b61d444e14e50db6a83fdd2dca9ae522a34268c4cc47225777b0341a1f93b107dff8220de5ccca6f5bc992049312aa5a9cb1125a2840a2ba45aa4
TLSH
T1BF21C643C5A72CF13F66E1A7808C5FBACEA4303244B650A0455E874722EE55C7B8E105
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\targeting.snapshot.json
Size 3KB
SHA256 b9a49a561482ba1b2e0848d2a5d072e30661d56075869c914e150a585f305753
MD5 6cf4fe610db5e9b7486c3b2d6207575d
SHA1 f25a5a703cbfb75abd6b16d5462260cc6b2fccba
SHA512 158266df64b228c18810376ef36415006c7dde023c0f043f83af9bf55dbb591605742758dc8a66877f1f30ccbd4dbfc541621c4e5dad0bb31abd44efdd0e98fd
TLSH
T198717F0CA61CA4BEA66BC3C0E6847FA78BBD053370447458DAFE460C95FB5FB122611B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

memory/4904-49-0x0000000180000000-0x000000018243A000-memory.dmp

Download

memory/4904-56-0x00007FF4FD390000-0x00007FF4FDDD2000-memory.dmp

Download

memory/4904-651-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4904-1-0x00007FF8BD544000-0x00007FF8BD545000-memory.dmp

Download

memory/4904-572-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4904-446-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4904-2-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4904-12-0x00007FF4FDE80000-0x00007FF4FDEB5000-memory.dmp

Download

memory/4904-25-0x00007FF4FDE80000-0x00007FF4FDEB5000-memory.dmp

Download

memory/4904-27-0x00007FF4FDE80000-0x00007FF4FDEB5000-memory.dmp

Download

memory/4904-3-0x0000000180000000-0x000000018243A000-memory.dmp

Download

memory/4904-28-0x00007FF4FDE80000-0x00007FF4FDEB5000-memory.dmp

Download

memory/4904-29-0x00007FF4FDE80000-0x00007FF4FDEB5000-memory.dmp

Download

memory/4904-30-0x00007FF4FDE80000-0x00007FF4FDEB5000-memory.dmp

Download

memory/4904-20-0x00007FF4FDE80000-0x00007FF4FDEB5000-memory.dmp

Download

memory/4904-48-0x0000000180000000-0x000000018243A000-memory.dmp

Download

memory/4904-652-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4904-114-0x00007FF4FD390000-0x00007FF4FDDD2000-memory.dmp

Download

memory/4904-112-0x00007FF4FD390000-0x00007FF4FDDD2000-memory.dmp

Download

memory/4904-113-0x0000000063480000-0x000000006370D000-memory.dmp

Download

memory/4904-26-0x0000000180000000-0x000000018243A000-memory.dmp

Download

memory/4904-86-0x00007FF4FD390000-0x00007FF4FDDD2000-memory.dmp

Download

memory/4904-0-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/4916-140-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-131-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-65-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-67-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-69-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-71-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-73-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-77-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-79-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-81-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-55-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-54-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-85-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-92-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-94-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-573-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4916-447-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4916-31-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-34-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-40-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-46-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-97-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-98-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-100-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-104-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-106-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-108-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-123-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-122-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-52-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4916-44-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-42-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-115-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-117-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-119-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-125-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-127-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-129-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-38-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-142-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-144-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-146-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-148-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-75-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-133-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-135-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-137-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-110-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4916-102-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-83-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-36-0x0000025B8CEF0000-0x0000025B8D07C000-memory.dmp

Download

memory/4916-53-0x00007FF8BD4A0000-0x00007FF8BD6A9000-memory.dmp

Download

memory/4916-47-0x0000025B8D140000-0x0000025B8D141000-memory.dmp

Download

memory/5116-1617-0x000002499D1E0000-0x000002499D1F4000-memory.dmp

Download

memory/5116-1616-0x00000249B6F20000-0x00000249B6F42000-memory.dmp

Download

memory/5116-1615-0x00000249B8800000-0x00000249B88A8000-memory.dmp

Download

memory/5116-1613-0x000002499D180000-0x000002499D188000-memory.dmp

Download

memory/5116-1612-0x000002499D150000-0x000002499D15A000-memory.dmp

Download

memory/5116-1611-0x000002499CC00000-0x000002499CC2C000-memory.dmp

Download