hxxps://github[.]com/Rowmbo/Nightlight

Analysis

max time kernel
166s
max time network
166s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
01/04/2025, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Rowmbo/Nightlight

Score

7^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ .scr	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ .scr	nightlight.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ .scr	nightlight.exe

Loads dropped DLL 56 IoCs

pid	Process
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
41	discord.com
42	discord.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
187	discord.com
188	discord.com
226	discord.com
227	discord.com
40	raw.githubusercontent.com
49	raw.githubusercontent.com
52	raw.githubusercontent.com
184	raw.githubusercontent.com
185	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5160	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001500000002b893-2130.dat	upx
behavioral1/memory/5264-2134-0x00007FFBE13D0000-0x00007FFBE19B8000-memory.dmp	upx
behavioral1/files/0x000700000002aeac-2154.dat	upx
behavioral1/memory/5264-2162-0x00007FFC10F10000-0x00007FFC10F1F000-memory.dmp	upx
behavioral1/memory/5264-2161-0x00007FFC07AF0000-0x00007FFC07B14000-memory.dmp	upx
behavioral1/files/0x000600000002aecd-2160.dat	upx
behavioral1/files/0x000800000002aeaa-2163.dat	upx
behavioral1/memory/5264-2165-0x00007FFC06D80000-0x00007FFC06D99000-memory.dmp	upx
behavioral1/files/0x000700000002aeaf-2166.dat	upx
behavioral1/memory/5264-2168-0x00007FFC06D50000-0x00007FFC06D7D000-memory.dmp	upx
behavioral1/files/0x000700000002aecc-2169.dat	upx
behavioral1/files/0x000600000002aeb6-2187.dat	upx
behavioral1/files/0x000600000002aeb5-2186.dat	upx
behavioral1/memory/5264-2189-0x00007FFBE2BC0000-0x00007FFBE2BF5000-memory.dmp	upx
behavioral1/files/0x000700000002aeb4-2185.dat	upx
behavioral1/files/0x000600000002aeb3-2184.dat	upx
behavioral1/files/0x000600000002aeb2-2183.dat	upx
behavioral1/files/0x000600000002aeb1-2182.dat	upx
behavioral1/files/0x000700000002aeb0-2181.dat	upx
behavioral1/files/0x000800000002aeae-2180.dat	upx
behavioral1/files/0x000700000002aead-2179.dat	upx
behavioral1/files/0x000700000002aeab-2178.dat	upx
behavioral1/files/0x000700000002aea9-2177.dat	upx
behavioral1/files/0x001500000002b8a2-2175.dat	upx
behavioral1/files/0x001500000002b8a1-2174.dat	upx
behavioral1/files/0x001500000002b897-2173.dat	upx
behavioral1/files/0x000600000002aece-2170.dat	upx
behavioral1/files/0x001500000002b891-2188.dat	upx
behavioral1/memory/5264-2193-0x00007FFC0B960000-0x00007FFC0B96D000-memory.dmp	upx
behavioral1/memory/5264-2192-0x00007FFC06AA0000-0x00007FFC06AB9000-memory.dmp	upx
behavioral1/memory/5264-2196-0x00007FFC0AC70000-0x00007FFC0AC7D000-memory.dmp	upx
behavioral1/files/0x001500000002b896-2195.dat	upx
behavioral1/memory/5264-2202-0x00007FFBE29D0000-0x00007FFBE2A8C000-memory.dmp	upx
behavioral1/memory/5264-2201-0x00007FFBE2B60000-0x00007FFBE2B8B000-memory.dmp	upx
behavioral1/memory/5264-2200-0x00007FFBE2B90000-0x00007FFBE2BBE000-memory.dmp	upx
behavioral1/memory/5264-2199-0x00007FFBE13D0000-0x00007FFBE19B8000-memory.dmp	upx
behavioral1/memory/5264-2204-0x00007FFBE28B0000-0x00007FFBE29CC000-memory.dmp	upx
behavioral1/memory/5264-2203-0x00007FFC07AF0000-0x00007FFC07B14000-memory.dmp	upx
behavioral1/memory/5264-2206-0x00007FFBE2880000-0x00007FFBE28AE000-memory.dmp	upx
behavioral1/memory/5264-2207-0x00007FFC06D80000-0x00007FFC06D99000-memory.dmp	upx
behavioral1/memory/5264-2208-0x00007FFBE27C0000-0x00007FFBE2878000-memory.dmp	upx
behavioral1/memory/5264-2210-0x00007FFBE2440000-0x00007FFBE27B5000-memory.dmp	upx
behavioral1/memory/5264-2212-0x00007FFBE2BC0000-0x00007FFBE2BF5000-memory.dmp	upx
behavioral1/memory/5264-2209-0x00007FFC06D50000-0x00007FFC06D7D000-memory.dmp	upx
behavioral1/memory/5264-2213-0x00007FFBE23B0000-0x00007FFBE2437000-memory.dmp	upx
behavioral1/memory/5264-2214-0x00007FFC06680000-0x00007FFC06694000-memory.dmp	upx
behavioral1/memory/5264-2217-0x00007FFBE2380000-0x00007FFBE23A6000-memory.dmp	upx
behavioral1/memory/5264-2216-0x00007FFBE2B60000-0x00007FFBE2B8B000-memory.dmp	upx
behavioral1/memory/5264-2215-0x00007FFC0A6A0000-0x00007FFC0A6AB000-memory.dmp	upx
behavioral1/memory/5264-2218-0x00007FFC07A60000-0x00007FFC07A6A000-memory.dmp	upx
behavioral1/memory/5264-2220-0x00007FFBFC240000-0x00007FFBFC258000-memory.dmp	upx
behavioral1/memory/5264-2219-0x00007FFBE28B0000-0x00007FFBE29CC000-memory.dmp	upx
behavioral1/memory/5264-2221-0x00007FFBE2880000-0x00007FFBE28AE000-memory.dmp	upx
behavioral1/memory/5264-2225-0x00007FFBE2180000-0x00007FFBE22F3000-memory.dmp	upx
behavioral1/memory/5264-2224-0x00007FFBE27C0000-0x00007FFBE2878000-memory.dmp	upx
behavioral1/memory/5264-2223-0x00007FFBE2440000-0x00007FFBE27B5000-memory.dmp	upx
behavioral1/memory/5264-2222-0x00007FFBE2300000-0x00007FFBE2323000-memory.dmp	upx
behavioral1/memory/5264-2227-0x00007FFBE2140000-0x00007FFBE2177000-memory.dmp	upx
behavioral1/memory/5264-2228-0x00007FFC06D10000-0x00007FFC06D1B000-memory.dmp	upx
behavioral1/memory/5264-2230-0x00007FFC005E0000-0x00007FFC005EB000-memory.dmp	upx
behavioral1/memory/5264-2232-0x00007FFBFD350000-0x00007FFBFD35C000-memory.dmp	upx
behavioral1/memory/5264-2234-0x00007FFBFC080000-0x00007FFBFC08C000-memory.dmp	upx
behavioral1/memory/5264-2233-0x00007FFBFC090000-0x00007FFBFC09B000-memory.dmp	upx
behavioral1/memory/5264-2231-0x00007FFC04B90000-0x00007FFC04B9C000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3548_803226601\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\pa\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1863789250\_locales\ar\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4704	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4572	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133879977175803770"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1678082226-3994841222-899489560-1000\{CF72B928-FE2A-4E4C-927F-E82935C64938}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nightlight-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
5264	nightlight.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5264	nightlight.exe
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeSecurityPrivilege	5096	WMIC.exe
Token: SeTakeOwnershipPrivilege	5096	WMIC.exe
Token: SeLoadDriverPrivilege	5096	WMIC.exe
Token: SeSystemProfilePrivilege	5096	WMIC.exe
Token: SeSystemtimePrivilege	5096	WMIC.exe
Token: SeProfSingleProcessPrivilege	5096	WMIC.exe
Token: SeIncBasePriorityPrivilege	5096	WMIC.exe
Token: SeCreatePagefilePrivilege	5096	WMIC.exe
Token: SeBackupPrivilege	5096	WMIC.exe
Token: SeRestorePrivilege	5096	WMIC.exe
Token: SeShutdownPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	5096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5096	WMIC.exe
Token: SeRemoteShutdownPrivilege	5096	WMIC.exe
Token: SeUndockPrivilege	5096	WMIC.exe
Token: SeManageVolumePrivilege	5096	WMIC.exe
Token: 33	5096	WMIC.exe
Token: 34	5096	WMIC.exe
Token: 35	5096	WMIC.exe
Token: 36	5096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeSecurityPrivilege	5096	WMIC.exe
Token: SeTakeOwnershipPrivilege	5096	WMIC.exe
Token: SeLoadDriverPrivilege	5096	WMIC.exe
Token: SeSystemProfilePrivilege	5096	WMIC.exe
Token: SeSystemtimePrivilege	5096	WMIC.exe
Token: SeProfSingleProcessPrivilege	5096	WMIC.exe
Token: SeIncBasePriorityPrivilege	5096	WMIC.exe
Token: SeCreatePagefilePrivilege	5096	WMIC.exe
Token: SeBackupPrivilege	5096	WMIC.exe
Token: SeRestorePrivilege	5096	WMIC.exe
Token: SeShutdownPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	5096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5096	WMIC.exe
Token: SeRemoteShutdownPrivilege	5096	WMIC.exe
Token: SeUndockPrivilege	5096	WMIC.exe
Token: SeManageVolumePrivilege	5096	WMIC.exe
Token: 33	5096	WMIC.exe
Token: 34	5096	WMIC.exe
Token: 35	5096	WMIC.exe
Token: 36	5096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2904	wmic.exe
Token: SeSecurityPrivilege	2904	wmic.exe
Token: SeTakeOwnershipPrivilege	2904	wmic.exe
Token: SeLoadDriverPrivilege	2904	wmic.exe
Token: SeSystemProfilePrivilege	2904	wmic.exe
Token: SeSystemtimePrivilege	2904	wmic.exe
Token: SeProfSingleProcessPrivilege	2904	wmic.exe
Token: SeIncBasePriorityPrivilege	2904	wmic.exe
Token: SeCreatePagefilePrivilege	2904	wmic.exe
Token: SeBackupPrivilege	2904	wmic.exe
Token: SeRestorePrivilege	2904	wmic.exe
Token: SeShutdownPrivilege	2904	wmic.exe
Token: SeDebugPrivilege	2904	wmic.exe
Token: SeSystemEnvironmentPrivilege	2904	wmic.exe
Token: SeRemoteShutdownPrivilege	2904	wmic.exe
Token: SeUndockPrivilege	2904	wmic.exe
Token: SeManageVolumePrivilege	2904	wmic.exe
Token: 33	2904	wmic.exe
Token: 34	2904	wmic.exe
Token: 35	2904	wmic.exe
Token: 36	2904	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3944	3548	msedge.exe	78
PID 3548 wrote to memory of 3944	3548	msedge.exe	78
PID 3548 wrote to memory of 5212	3548	msedge.exe	79
PID 3548 wrote to memory of 5212	3548	msedge.exe	79
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4540	3548	msedge.exe	80
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81
PID 3548 wrote to memory of 4292	3548	msedge.exe	81

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3468	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Rowmbo/Nightlight
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x288,0x7ffc076af208,0x7ffc076af214,0x7ffc076af220
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1748,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1408,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5296,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5168,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5668,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1148
    3⤵
    PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5000,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6368,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6212,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6000,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3964,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6916,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3652,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7244,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6432,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6364,i,16100869442234213787,5626731281289005869,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5724

C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe
"C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe"
1⤵
PID:4820
- C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe
  "C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ .scr"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5160
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ .scr"
      4⤵
      Drops startup file
      Views/modifies file attributes
      PID:3468
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:5900
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5096
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:5316
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:8
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    PID:4532
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    PID:1124
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:224
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:1344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074fdcf8,0x7ffc074fdd04,0x7ffc074fdd10
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1824,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2076,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2388,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2404 /prefetch:13
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4148,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4168 /prefetch:9
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4668,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5268,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5472,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5688,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5684,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5720,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5716,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5788,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5288,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4740,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3476 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4704,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3224 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4768,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4828,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3192 /prefetch:9
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4244,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3476,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4760,i,12115617684989478861,11722973740908409695,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1256

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\606bd5bd-a127-4c41-8cc7-8e3f1ad59c30.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6232728d81f18a267eecf3d8f9716bef

SHA1
3277e2f88e9bfa84c3279d92887702f02b62d198

SHA256
0fcdefeacc698fc3b25c2addf8bb480fd7f41f80922230463ba8555e1f4705e6

SHA512
d7ad1f3916939a9c308833fc6c931b4d279b1afd9bfeb321e836e65a821d7900c26b1085760c68e37b4b842fe5c3542777838394189f300e01102c22ba0f5398

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
480B

MD5
cb55ff2ef07777bb909a682b8d3bced2

SHA1
60e17e3effcb5899b1a4436fbc8e2f0c2f05de48

SHA256
95051138a1110714fbf91d37cda7585726479a7340bc4a81f8724366d9f3fc47

SHA512
4206ca5f6856f7404ce472164d012e3b439b0e05066bf9246aaef7c79eca8fd250c64d6e1cd699b1fea2803430e6a55d90894add6f6fb243b52f7ad5bc785ba4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
9a90127f5544139b4d6df1fed2ca92fa

SHA1
d4e7bb97bd5c399697a8e410d0a483103ef17c8a

SHA256
78c8888a6029fa00b2f8be9ef9366a32f5e8647a5c5719c835a921ebfa1b3b55

SHA512
c336e103c2ec729ec8380fdd1e585479bb13d6b38c7961527bf9a1172861499ce506833419c74e19a553aeb10da02323dad638a8381af0489b3699bad3e83529

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
59c582e4c60100796cb1f7b3ba797dc6

SHA1
2b71883ee686a2d3d472eee8f4a47d9ada1c8939

SHA256
8dbce27dfa6d688dff6c88febfb5e47ac6502c605a896bffd424a699e5077803

SHA512
12b0bb14689920cfae9bd0501ed9782311ab8092ee48aee55d41f5cdf7310fab819b4fe0f21985e0e68ed734649495fdeabb1a0ac027137d8f2932075036a0de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5db10f49ad78146bc60ae03a505cdbc9

SHA1
dd8e8132f63ead9c26135df97a070de6db50092e

SHA256
76b6072a5795c220d9d60b4044965389a00d30c8d2c625b26a39142c4be332fd

SHA512
8e93c6e874c691123172c2aa59a69a6677f2c9d23a680a04e03c9ee754dc992fe127b46e0875a278a34a8d893c3fe83d0a340665ab9d0995964aaf60f436cd30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
27fd91dff933d088d7bcd117e5a3c307

SHA1
d96cf675ed6b0d9a782e14cfe2400d0d6d57cf18

SHA256
800253055d1440d215ce0eba16c1a0cbd91c9547801daa4a9ca7a563d743d07c

SHA512
ef27073e5d6b954f92a7b389a3d2fd4b560f742533a7d263926342c541ee562048e9d72641a3fa9844a32a8c1754ef23ebd220f01cb6b98ee446e0acb5ff215f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
6fd7e2cb80af84c9d43cc7ac80836d0a

SHA1
d3b6d309949e529e5110105c3bb169b3481bf42c

SHA256
3f670903e7aff45038f32f105c3e4b778b7a823bef4dbcc7b62ee57eab229fc2

SHA512
8be64165e64ba831af98f6430470df821d1200eb19c7a009feb756960a9f0f70fb1f002f91c6f2bb8e07829ec3558e35337a7aa7d5d7bf381642135f67c8b7c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b2baeca7cc429d61870cd8995c2e3e29

SHA1
330e5c9ffad83b94fd6ac647171bf5f38171f22e

SHA256
5577df66392d62d6b68bb8f050c94c548ac1e857cba1853c20677593e17563b6

SHA512
48664db7aad536162ca7c196364d8d2a1732a289ebd5bba61fb157ee4b3cdc06e0294a2c13964056f0731e947c96eebeaf22dfd232b30706bc434ef7b52cb00a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0dc78212dafaad330369fa4e17551d7f

SHA1
1309115e2b0131f8ac308cc0aa8b3c423a904f94

SHA256
58b0f4a00079f7f6870caaed4ce0580aa9765d59de57199753335ee9ea100656

SHA512
ed4bb5b8a565f4b4f73dd420b1d4ef280ab159552fce594deaa437710316bbbf9c39b66380af40a7cf371f55d03e11aa743a81e2fcdc53133d6b9caeefafaa53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
8f70e7e577e1c229965c9b6cbbade8a3

SHA1
bfc2e40b65efc58622cc2021f93e1f6169fd3dd0

SHA256
81abd516939053bf5a5f29dbf63b72146fb17b09c34d884e57d48848c34b964b

SHA512
7f1a37359bb7c2813683c8f442622fa2c3f4e318f825fe91071a509009d78f5e93cac271c04a31a77cffb56841c27d0ffa00f4e17e520441ada896f6cbe24962

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ce96.TMP

Filesize
48B

MD5
7157efd17a272abfab49385067086194

SHA1
ed67951a83bf1d73fc684eef8ba219ffad969b85

SHA256
2cd5839435513f8888bbec2f25b61da51e5b99025e7c5ded64fbe61c758b2a16

SHA512
9e1032d1a7ae1d9d8eca6516daf1e23c88661314b7aa4d03386dbc1336646b5a6d89ed07d9004cce9f8818093e02760228b73d86ff1c0911db7f223d77438c9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
dbff64446485eb92c7fc7a535659295c

SHA1
5254f35e36d97916d9f0adc3a199b1e3950ae404

SHA256
f65c4c4f9aa89e0caa62f952375e56b3e0ad815f3989deb93487215d1d15d49f

SHA512
6ec22743606f03d7a94ffb585b0bd7a27a39c4349396e143857934acd269a7dfcfd48b4bd11b73658d752f3e01075e9d4c25c5546ead833fe0af92b171a78911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
6ae072c6ae673b9b9b8d733597e54ff9

SHA1
1154dc52dc60fe90ec5ab7091a0d674d97f37599

SHA256
27da8bfac7eac1fec1cd61e3aaed4956acc1e4f75a16149918fdd19d64095ae9

SHA512
5b51ff5c7e3cfab4c6e299265fdf843b4c2c090795ac67b56991870f5ff8a42558f5f2cb92d1eb2a167ff482515e50f019f2962c9b329c08f8cf413620e00483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
1fc42b98655fc6cd5b7dbd78202c9d17

SHA1
a6871b8052df48c28f973038b70a3828b8e8cb1c

SHA256
93bf0d697a217247b1ec78b39d36ee9855e60a3a51e1177613e9c2bcd84cc2de

SHA512
5846f1b7fda1cd41b60e33800b0c5eabb9072526b6457481630342ffe0326603a0098b9a8e03b66ae3f4fb20ba72c70e39ddcbf8ea8ccf136840145e7652e28d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
19a88bad99bffbae6102e191cfedd75b

SHA1
df476b325df883b73eda1b2349bab45aa22e808d

SHA256
0d576dfbde1712b7288e4561e3eea75ffdad84dc50a77ceb57a6e9c37d60465a

SHA512
9ec5eb487d8c8fc8e283a94bd43afd740edc4df6a4509d83629416d040586bd42330eb0da6dd41ec1e5550bce9a6643319ff8584f8638a9cde9042fa406825fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
54e13fd30ad7964655358ba8085c501e

SHA1
4853bd1ab4afef47056fef5c5134faab34f1267f

SHA256
97a68912fc313f2cbbad188d69a343b3707956abf797ba03bcf28bbc5a33a404

SHA512
9219d15024530720283a87a60eb5bbfd3613ee11d8ffb4ab1c41bdacbf45af0b304e2d5363a34edeb87950efe2f682da27b165a7fc2b266f13b4474c910b21c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
4367f9142a6df0fdb14b0d21ba5a45b6

SHA1
242aa117959af395528c6246bc166a895978b36c

SHA256
24568adbca22e38c7ccf040ba3ae27fe57cb20e1985df307674f1cc9d6e1a023

SHA512
c9b2dca557e625b458e737c01ebe3622ed7740b97a42d20e4ca85cac4119c3d691e2acf310e1b2cb994384cd20c3b0e9cfcc5c96634aaf10d4e61bc27356fbc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
fc2bd3ff307c9e3b5121831ff1285b19

SHA1
b9925158ed44b79992555362b19c80b1d5e427dc

SHA256
ef114daaa8eb6f9507cc27c55d0b21fb152b6bde2deec22823da0fe107bd90f5

SHA512
2442ccc8523120b6eadd71b3b540a06cecb0b384f90f857bed0b7e8c34add2eb68935c4e7b4775f860b15d9132ddd4391d64da53f02ddcaf1333e3e6281437a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
10435bc59720e38ad9a1c8ba1d1df11c

SHA1
eebb87fd909e489e5e3855745aa2a5ad172e5d99

SHA256
b7910640f2cc3f95ad9b6e63f94322b50357379a294d218caeffd75b712e278b

SHA512
e7c34970aa6f47ec254be28a08f092090a34589732d39b7f1ef6372dc06db87a844ce42e20a7ad26d9e87e97048cc8c4c10c8275c12309a2c048db6ce29fe36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13bf7cd5-3f0a-4967-869d-004c84656018\index-dir\the-real-index

Filesize
72B

MD5
9ecda4d271d997b2bb45a6a5ff549741

SHA1
3474610fe07483c9daab01a524c5dc3f8fccdbc7

SHA256
96f21a18b7318a1299d4f232a70584dd241b725f1f800d9405258618fbdbed03

SHA512
3059e60aaf3eea0cccc9a98b70f4d2b8249212953221742f0346c6c559f1fdd4ec83552d858e53cab371d664e435315da0cf649244a9778ca3451e5d5b0cc30f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6de81848-5b24-4103-b044-7a04b1ce3981\index-dir\the-real-index

Filesize
2KB

MD5
54419cabb7219fcc1b2ae1bfdfab2dd6

SHA1
14438f06a77af3d68516d6ca60aa30cd70c9385e

SHA256
db20026b589465253a17a6126c1a447f807c088828a7526e4473b0bece52d9d5

SHA512
8e13231ce91e5628e6c6878a60750c74c5088222c48c8ce1970886f96ddce4c432f8e64cf564996c29a62f939e742a1b8ba3bd7fa6fed59a6333a519cd96a70a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6de81848-5b24-4103-b044-7a04b1ce3981\index-dir\the-real-index~RFe5851a5.TMP

Filesize
2KB

MD5
192d5913b01000502209a70682fa4683

SHA1
923727cbb99d233d237fa3c0cefdfb012ce04cc7

SHA256
52b7ea49eaf1d1a6c7b0fabdfe48df6b3a141609876edb627ff33aedbd9712b1

SHA512
44eed60465863a51142acce4671dfed34834216754bf4bf0029317a8ec78688f0329635fa09137dbd33907b04b8ada8d5f4f073c910ed64045fbcb221e02a9cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8e77bcae-b7a1-42ac-8024-0388d8ff6bd4\index-dir\the-real-index

Filesize
72B

MD5
04d0ec2e8e23313029c09f7fa2ac5ff0

SHA1
667c1e1b02f4817e6c49c26d2193f082527d5be7

SHA256
7458be967c47a30afe7333f4e622509c147593dc7d5dd71d014a0a6dfe6f1d7e

SHA512
3dc5e1611b003adf646357efc620e7042b09775d612b8d66183529068baed914708a204a7e0ed2325e2a6a9374354a1c257d42fd8780d5894150dfc05c853087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8e77bcae-b7a1-42ac-8024-0388d8ff6bd4\index-dir\the-real-index~RFe583f75.TMP

Filesize
48B

MD5
c18b72ba4c5dbb51e655a61c625c658a

SHA1
62f53a98d35c30445c9b7e1b1c98a8babdf111c1

SHA256
d78d56094411e808a1cd8a59c7f5e813c7bda00df27968ed9c3301a7eef2dca9

SHA512
0eb2d2bfeadc8c8730a0a2cafc0f49058e9c7786abc953036fedf0d47bc2d4b2e4752bf11e7fb74a7d1c2d521c9d6216078b4928c366bd31fd28d1c9893e2bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc7ad1e6-2a51-4dc0-9579-f8bf6674ff51\index-dir\the-real-index

Filesize
72B

MD5
135ae5b5e7247e031f570f7183bcbca7

SHA1
7f612d386ac9e8db048ee8027001ea960e3274e3

SHA256
551996d741d0c871cd4af354e40adfb511ff27e1c6725d59557ff2874e1e46ac

SHA512
86662d9ed08874183544c0a52d7f07aee255df6cb53c6564a2c1761c10328cb7ec1916dfb7bbe618bc78558f70e3d02e14eb7f12fc6ac7396287602a9100811c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc7ad1e6-2a51-4dc0-9579-f8bf6674ff51\index-dir\the-real-index~RFe5841e6.TMP

Filesize
72B

MD5
eab181850c9148238129e1c28f08cc4b

SHA1
a35ae3ab950ab1fa5ebb385f035a6fe304c28431

SHA256
a0ad440ff1a617bc6e7307b9d4d57e4c1912dd742f37c30f9ee9ad7b44829e77

SHA512
c8cb0ae2bd565f03c71bef6bcad9165addf560c6cbc6a75bc407c2aecd579440a81737e25706e0d92bcb56ad33cbe8b2d90f597f168c9ef015d11e8a6ee560e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
276485a772ee097afc80797ac0e9b539

SHA1
af96c057de0720430f2b00e4abace93deddff4bf

SHA256
9615ca0b4ce1a3c39edb1b777485b42eef6351479b9dfc2e1919aea42309d878

SHA512
123f09a6eb8048cce1ce5364dd3596e3e65b3c99c90f48b30721fe667624108cd691da02edd4c8dee63ad3dea4dc33f681cf25eebe78d114712b23e216d8b39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
c3d8c23994d1ddb8f1a92c2f08f62aa0

SHA1
a3a2140d9a73c9342c7548f7496c62590de85793

SHA256
3290cf0b56b2e9e9050d77a04058f72010bdf8627278a2549e542d6c38011a0f

SHA512
23466f5f4fd7323aa7523eb21278dac3228954e3db0eb6a47c73307a5cd66f1bf2e2628c30d725b9ffd4b96336a0011882d5ea78a09e549aabb95f2f22de2224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
935bab4446e87cf8ab019a411cf715b9

SHA1
3ec4ffcd422df4a8f91f8d086cdf961b19fed255

SHA256
af4ffbe4ac77280b182c518f627709c9be0233018410ee33ee9f86dab0343145

SHA512
6c044cf4a91c80608cc36194efa9e0aec6a7b8819c6e8ca0ea03065ea635e8499137d84c68470c9dfaac92a5b97d1c0a3c1bdad0697eacbbb102868b136a266a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584d60.TMP

Filesize
72B

MD5
45c76fcbcb90e6dc3f5b459bf3caf22d

SHA1
9ba05e5a443cb40632213a1d90c7b4736f5cdea4

SHA256
0c8357ca53998510b4c90d3f41598bb18e8711519adb99f4af0bf8bbb73ab19c

SHA512
afe63ba4b3442aa3faf18e01e38f2541f875664bbdd970950e447a5977cbbfc21cf82cf3e1389160d5be63d41898ade66b8cf2a13c33ab3b06dbc1955c70a099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
bd3d699926f10d96e5154f56ec13ce69

SHA1
da1e6d9d99e5ecca9800f3147ef4de1b3d3569ed

SHA256
94e9c1344e45c68e695f35d752625fb8e0170324582605a6fd11395b61c9095e

SHA512
c324b598bf30a1f363647ad5c41708daf1c33c91bb3457529d0a39bd90e4d7152767906c0adb6eb177b2be89c0723d1f24eeb554a42e5448593099e3802703a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
1855c3919b9def1955e0ba286fbe4f01

SHA1
365d71b044d69632f76409775652e994ccc787ff

SHA256
6ba7f1016443c01028e511982b611afc2692719f6f998e16896dd5a4faa0e23e

SHA512
33e0d69de322017114f1151cc228caf6c56c3c984404eaf4d2ab49e964aed31ea341151653a83716c816e54e3ccf7efc31b35dff7c8484e3640cf5ab9cb73a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
be71cefe155e04e3eabc0180c9739740

SHA1
af10fdd37e05c18dc8fbf20cd7b14d459a463432

SHA256
596bef243644427ba6a27b62789a3281c735563bb421239924b073dffb2ffb7b

SHA512
e9321a9d94160ee72ba957c99e11133bde4b5ceb5051b2d62653f1e67736da3850168461864fc96fd9b789a5435527a466e685874f2bedea64dc3fddc2b5072a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
abbc35a391d6247d8ff0431f37c5cd6d

SHA1
789f396a5b0c080410e43f006a7dfb3c79f3e870

SHA256
c6a6a99df2c37b7f4dab7c680e9ff3dfa8377cf857dc0cb50b719d59b097ad7a

SHA512
1e1194b3889ba87248f894d94478f49956e3923ba0b9f9e9709e69500bd352e3c5ed568a780232926d9a5fc3e58016426c58c96273ca2734621a666227a41bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
b2453e74163031db99a66a65b6d9eaf2

SHA1
d16688e0a5fc0cfe99c52575c7d42eb6930f45b3

SHA256
76ae696fcd7a61d1572edbe92b8681d69cc155e8857f3d67060f3a8a87b3494a

SHA512
11d2578d9a237928760d01579daf71bac95056e281448d513559c626e9fdb528af75332e488327e2051319ba1c200c0ee8f7c82599aa8c3f2138fb667aa7d5f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5827b7.TMP

Filesize
392B

MD5
d653b6149510c7f3baf158bc5caf1b29

SHA1
6b46002dd0793da0e19c7818749f80ae20dab7e1

SHA256
e974cd23920d7618d2ce9389569b2c799486eb5258ceecc30c85596b8dadd0cc

SHA512
a7a5b4ca331c98558f4d37e1d0b526fe7099a314a609b8aba4166c228c97f0f49ac4d6690f1f544b4f3d478c5c45ef67f509e3e3d7b7f863181fcb5b0b8f9d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\JA4GasDYGj\Browser\cc's.txt

Filesize
91B

MD5
5aa796b6950a92a226cc5c98ed1c47e8

SHA1
6706a4082fc2c141272122f1ca424a446506c44d

SHA256
c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c

SHA512
976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_asyncio.pyd

Filesize
34KB

MD5
936e44a303a5957709434a0c6bf4532e

SHA1
e35f0b78f61797d9277741a1ee577b5fe7af3d62

SHA256
11f1062fafb4fbca92e3b2cef97ab66ec011142f5b0312e74815decd93be458b

SHA512
cebe905b718825c1841e9c0e83dfdac95d0ff50b116ab3b91b05ca21f86f1482f5b1e13988c969244c644d17bd378792ac4967caa721f0b0e858cd92859af154

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_bz2.pyd

Filesize
46KB

MD5
af3d45698d379c97a90cca9625bc5926

SHA1
0783866af330c1029253859574c369901969208e

SHA256
47af0730824f96865b5e20f8bba34b0d5f3a330087411adba71269312bf7ccec

SHA512
117e95d2ba0432f5ece882ad67a3fbf2e2cd251b4327a0d66b3fffd444e2d1813ddb568321bde1636b4180d19607db6103df145153e4ff84e9be601fd2dd5691

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
f5a0e3f73ad4002839a85ec9b5285cc0

SHA1
2657e49964491d8b0784ab6ae157c767cf809673

SHA256
34dff4546abf4cd9d1e605f215339e6816c3aa4ef3c6028afcf00cb6241dbccf

SHA512
81d683f45b6ea1b48d0e377779c9b87ddff5b8549f00ae375ebe617fbd00d0149639a2b5c1b42ea536bde786aea50025646311b3de243c48ed192014dcc9974b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_ctypes.pyd

Filesize
57KB

MD5
2346cf6a1ad336f3ee23c4ec3ff7871c

SHA1
e36b759c0b78d2def431aa11bcbb7d7cf02f1eea

SHA256
490a11d03dd3aeb05a410eb0d285e3da788e73b643ea9914fffd5a2c102dc1df

SHA512
7a92de4937b23952e2a31bb09a58b2ad81c06da23704e4b4f964eb42948adad1a1e57920c021283da1b7154e7ac19e46031ffee6b69a73acbc85d95ef45bf8ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_decimal.pyd

Filesize
104KB

MD5
9b801838394e97e30c99dcf5f9fcc8fa

SHA1
33fb049b2f98bcb2f2cb9508be2408a6698243be

SHA256
15668e03f9c55f07184ec9c048a8569f7d7ebd9ea6dbef145f1f3b581f8623f3

SHA512
5f074c82f344ca43a07a59132fab59e3504e314a2f7673bfec906782b947daf8fe45a1b956f72502eae72f01369a3bb1fbb73b10dc605d43b889a6700bd98a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_hashlib.pyd

Filesize
33KB

MD5
7fd141630dfa2500f5bf4c61e2c2d034

SHA1
0f8d1dfae2cbce1ad714c93216f01bf7001aabda

SHA256
689f0ac1d44481688cd4ae90b6f801176a52ff4bb4170c62575ea58f44452e15

SHA512
c6b7b1aefb7280f38d63f4ab84a349ebb696ca7300b7a451e7a994baff7e0a83fb4488c43ed3160b94dec74e0d27417d68913056b3006c8c6da11e39681f512e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_lzma.pyd

Filesize
84KB

MD5
ab6a735ad62592c7c8ea0b06cb57317a

SHA1
e27a0506800b5bbc2b350e39899d260164af2cd1

SHA256
0ebdf15c1c6d59e49716dfb4601f0abe6383449c70db1a349c6ad486742144a8

SHA512
9a285593cd8cc29844688723d8907e55a9f8a3109f9538cc4140912cc973f495de32779a4cd4a48dc62d680fdf81a5797e4e9c33f236a803082dfc3c00d02060

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_multiprocessing.pyd

Filesize
25KB

MD5
241a977372d63b46b6ae4f7227579cc3

SHA1
21c8fa02217ec69c5cc9a1cc9edaa5de6f8d9f91

SHA256
04e56f1c6919f2987f205e9e3afa16d945eeaffa415c746104ccb7763c067f9c

SHA512
7aeaa94a5cd46d604370e430c72724b683e149af7e032c85708e33bfb94fb6a9ccc52c70bc701dfb94b4ae55d4e8acd8e394efb6cd81466fd9fa1a6addaa4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_overlapped.pyd

Filesize
30KB

MD5
ef52dc3e7d12795745e23487026a5b5e

SHA1
6c9f488a9eaabdc6db11ed2c32231d518a8b8f42

SHA256
b1b56328df4b19cf04586303f693979536253078fc7017b4ac4ae6d730296b1f

SHA512
8b3c311bf4a54eaa21fa1db058037b274bd3b9e838e844537269f8e0102ad47ca7181e73bbb4f5269100cfe82499bb0787bc04943b02e36ea0ab26bfa8e65326

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_queue.pyd

Filesize
24KB

MD5
71955beaf83aca364ed64285021781ca

SHA1
cac93d08f9085079fb32e6fc6d8e4fc8cd9115e6

SHA256
3df280391d7275e73aef70af228bb21c03434147ae9fe31e8c620ea151e08b30

SHA512
9b055a0273ace0f9b673e015a20c8867689090608fffaf85c54636f061cf595de1e6c9bfc2d8ea75fa4dd247b4af0493022f24d6a931b53e7f60009a85b45601

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_socket.pyd

Filesize
41KB

MD5
53dc1aa457a1e3b4f6c8baed19a6ca0a

SHA1
290a572e981cc5ce896dc52a53f112d9eaaefc39

SHA256
26200892f616f859e82c167701ab866b8291eabbe808dd18c434cc80ebeedf19

SHA512
460de92115288e0e95fd03837df775e5f34425784c18ab7e9ad0885511166371647a6f06d95ffa6c3437de69895d46cd4cddcda2841ccdb5ef268b1a857837e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_sqlite3.pyd

Filesize
54KB

MD5
1c5e0718dce15682d32185f1e1f8df7d

SHA1
f59662db717663ed1589328c5749bb8b44a0d053

SHA256
56f74ec6490b916c513b618635edaa22cb2374a92e5f79549c1e2b7c5c37f31d

SHA512
702f8348d2fe08ec10e0120129e64c12368c971ea52852cd0c7d26fd159f5b34bc808b9b318168aaa81366ed4944909e305d4e9727f0374d921eddb54ea22cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_ssl.pyd

Filesize
60KB

MD5
df5a6f6c547300a7c87005eb0fafcfa0

SHA1
c792342e964a1c8a776e5203f3eee7908e6cad09

SHA256
dea09b9750c26813130ca32db0b4455796e12a3d61bb52066d5a53302bcce0ce

SHA512
018a79871faa2cf6a1644e96f10750ddccccd56436720faf760808b1997940f9bcd2866a4533b903058ab608629ff8ed46fadb788e4a6714b19775d557dd69b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_uuid.pyd

Filesize
21KB

MD5
cf378e1866edaa02db65a838f0e0ad8e

SHA1
cc66b98b3289a126fa4cf960d89cbbecff0f5aa8

SHA256
caabfac7123e70906fafe3a34d11c0c87c62695b2716a5f95b032bb54982744e

SHA512
cdb6fb5861fee4eeee49dd79ba164ef8538235b0b41e505dd59f1b5a79256390a4bb920ade9ff58abdc41c738ec6f316d387df4f588b673d8f324e5c1c32a9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\base_library.zip

Filesize
1.4MB

MD5
481da210e644d6b317cafb5ddf09e1a5

SHA1
00fe8e1656e065d5cf897986c12ffb683f3a2422

SHA256
3242ea7a6c4c712f10108a619bf5213878146547838f7e2c1e80d2778eb0aaa0

SHA512
74d177794f0d7e67f64a4f0c9da4c3fd25a4d90eb909e942e42e5651cc1930b8a99eef6d40107aa8756e75ffbcc93284b916862e24262df897aaac97c5072210

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\libcrypto-1_1.dll

Filesize
1.1MB

MD5
571796599d616a0d12aa34be09242c22

SHA1
0e0004ab828966f0c8a67b2f10311bb89b6b74ac

SHA256
6242d2e13aef871c4b8cfd75fc0f8530e8dccfeaba8f1b66280e9345f52b833b

SHA512
7362a6c887600fafc1a45413823f006589bb95a76ac052b6c7022356a7a9a6e8cd3e76f59cecf152e189323791d9626a6fdb7a98bf3a5250d517b746c3e84e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\libffi-8.dll

Filesize
24KB

MD5
24ea21ebcc3bef497d2bd208e7986f88

SHA1
d936f79431517b9687ee54d837e9e4be7afc082d

SHA256
18c097ef19f3e502a025c1d63cfec73a4fa30c5482286f4000d40d4784a0070a

SHA512
1bdbeddd812ecc2cdfbbf3498b0a8ef551cc18ce73fc30eb40b415fab0cdd20b80057a25a33ca2f9247b08978838df3587a3caf6e1a8e108c5a9a4f67dd75a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\libssl-1_1.dll

Filesize
203KB

MD5
aabafc5d0e409123ae5e4523d9b3dee2

SHA1
4d0a1834ed4e4ceecb04206e203d916eb22e981b

SHA256
84e4c37fb28b6cf79e2386163fe6bb094a50c1e8825a4bcdb4cb216f4236d831

SHA512
163f29ad05e830367af3f2107e460a587f4710b8d9d909a01e04cd8cfee115d8f453515e089a727a6466ce0e2248a56f14815588f7df6d42fe1580e1b25369cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\luna.aes

Filesize
294KB

MD5
073300e100dc8efd99efd3c781515e0d

SHA1
0d67d3f1261fa50929841f354093743c7d77678e

SHA256
b5405574857254bfaaf444da5d11e8fcc087261cd7f3bb6d77b5237cc769a9d8

SHA512
09f03eaa2f25fe7aaad32c09d3bae4f182cbcf4aa35e5202e31a7922328df72e8a3e3605ed286912a7267ffcb10ba9ced66ed474c3b7cd8b4ae99263a4354113

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\pyexpat.pyd

Filesize
86KB

MD5
c498ed10d7245560412f9df527508b5c

SHA1
b84b57a54a1a9c5631f4d0b8ac31694786cc822b

SHA256
297ec9e654500400ba5731101b65d29c14d0305ae9f6c05b9763f57ab150b07d

SHA512
ab8bcf6e4a395944316e19aa7aa598e8bfeaa038f4ae086fcede6d01747b670896d640dbf4992630fcbd737d2be3ab627b7be8ad36437629671387f4aaf85957

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\python3.DLL

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\python311.dll

Filesize
1.6MB

MD5
4fcf14c7837f8b127156b8a558db0bb2

SHA1
8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f

SHA256
a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc

SHA512
7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\pywin32_system32\pywintypes311.dll

Filesize
62KB

MD5
04ce7664658c9c18527594708550d59e

SHA1
1db7e6722aaea33d92fba441fca294600d904103

SHA256
e3be247830c23a1751e1bab98d02ba5da3721d2a85469eda3764fc583ca2a6ff

SHA512
e9744b2eee5fa848d5ac83622a6b1c1a1009d7ad8a944bda7a118dd75d8d24218fa2e4ef67718caabda0dd67efdd5be1497705afef8edec830f1b2402d0f0a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\select.pyd

Filesize
24KB

MD5
0dc8f694b3e6a3682b3ff098bd2468f6

SHA1
737252620116c6ac5c527f99d3914e608a0e5a74

SHA256
818120c08358b6b4d1234b7456c7b5c777af8473e26314a6a6c0f37237d53208

SHA512
d0e704d52b0c5e24c07447a60d71ccec490ec15ecb6b4532b2e93ac07036bda7f27051f80dac1ef3705b0186f35f9d6dfc05415412e483b68fd79f1098411123

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\sqlite3.dll

Filesize
608KB

MD5
605b722497acc50ffb33ebdb6afaf1f0

SHA1
e24c55472c827d4b519e5b6f0a3cfc49e10d1fa9

SHA256
a61016520a3f228285e32e40d878fe449450136c55aa9d4d7b54006a8dc7f339

SHA512
9611afc66cd1236cea1fce94e8ecf8e4d2168db3b51d8d9a799b574e8523ca0aea48da6b6c15fc863dd737b9c394ac6e56d2f3fa45e29792b630da389cb21dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48202\unicodedata.pyd

Filesize
293KB

MD5
2b1809546e4bc9d67ea69d24f75edce0

SHA1
9d076445dfa2f58964a6a1fd1844f6fe82645952

SHA256
89cbb2814a75a5bd53acbfb1fe090ca8395c4a7f559acd4fe0187758c172623a

SHA512
5ae015add4697e8290eb881fa770bca2fa22ba8376b86b26f7880d4f92ad362e741042926a4c47cc3413c83f445e372ffda915bcf8567673d807bd2dac28fbbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2120_1325850749\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2120_1325850749\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2120_1325850749\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2120_1325850749\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\Downloads\Nightlight-main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/5264-2223-0x00007FFBE2440000-0x00007FFBE27B5000-memory.dmp

Filesize
3.5MB

Download
memory/5264-2338-0x00007FFBE2B60000-0x00007FFBE2B8B000-memory.dmp

Filesize
172KB

Download
memory/5264-2217-0x00007FFBE2380000-0x00007FFBE23A6000-memory.dmp

Filesize
152KB

Download
memory/5264-2216-0x00007FFBE2B60000-0x00007FFBE2B8B000-memory.dmp

Filesize
172KB

Download
memory/5264-2215-0x00007FFC0A6A0000-0x00007FFC0A6AB000-memory.dmp

Filesize
44KB

Download
memory/5264-2218-0x00007FFC07A60000-0x00007FFC07A6A000-memory.dmp

Filesize
40KB

Download
memory/5264-2220-0x00007FFBFC240000-0x00007FFBFC258000-memory.dmp

Filesize
96KB

Download
memory/5264-2219-0x00007FFBE28B0000-0x00007FFBE29CC000-memory.dmp

Filesize
1.1MB

Download
memory/5264-2221-0x00007FFBE2880000-0x00007FFBE28AE000-memory.dmp

Filesize
184KB

Download
memory/5264-2225-0x00007FFBE2180000-0x00007FFBE22F3000-memory.dmp

Filesize
1.4MB

Download
memory/5264-2224-0x00007FFBE27C0000-0x00007FFBE2878000-memory.dmp

Filesize
736KB

Download
memory/5264-2213-0x00007FFBE23B0000-0x00007FFBE2437000-memory.dmp

Filesize
540KB

Download
memory/5264-2222-0x00007FFBE2300000-0x00007FFBE2323000-memory.dmp

Filesize
140KB

Download
memory/5264-2227-0x00007FFBE2140000-0x00007FFBE2177000-memory.dmp

Filesize
220KB

Download
memory/5264-2226-0x0000023C22E90000-0x0000023C23205000-memory.dmp

Filesize
3.5MB

Download
memory/5264-2228-0x00007FFC06D10000-0x00007FFC06D1B000-memory.dmp

Filesize
44KB

Download
memory/5264-2230-0x00007FFC005E0000-0x00007FFC005EB000-memory.dmp

Filesize
44KB

Download
memory/5264-2232-0x00007FFBFD350000-0x00007FFBFD35C000-memory.dmp

Filesize
48KB

Download
memory/5264-2234-0x00007FFBFC080000-0x00007FFBFC08C000-memory.dmp

Filesize
48KB

Download
memory/5264-2233-0x00007FFBFC090000-0x00007FFBFC09B000-memory.dmp

Filesize
44KB

Download
memory/5264-2231-0x00007FFC04B90000-0x00007FFC04B9C000-memory.dmp

Filesize
48KB

Download
memory/5264-2229-0x00007FFC06530000-0x00007FFC0653B000-memory.dmp

Filesize
44KB

Download
memory/5264-2245-0x00007FFBE20D0000-0x00007FFBE20DD000-memory.dmp

Filesize
52KB

Download
memory/5264-2244-0x00007FFBE2100000-0x00007FFBE210B000-memory.dmp

Filesize
44KB

Download
memory/5264-2243-0x00007FFBE2300000-0x00007FFBE2323000-memory.dmp

Filesize
140KB

Download
memory/5264-2242-0x00007FFBE20E0000-0x00007FFBE20EC000-memory.dmp

Filesize
48KB

Download
memory/5264-2241-0x00007FFBE20F0000-0x00007FFBE20FC000-memory.dmp

Filesize
48KB

Download
memory/5264-2240-0x00007FFBE2180000-0x00007FFBE22F3000-memory.dmp

Filesize
1.4MB

Download
memory/5264-2239-0x00007FFBE2110000-0x00007FFBE211B000-memory.dmp

Filesize
44KB

Download
memory/5264-2238-0x00007FFBE2130000-0x00007FFBE213E000-memory.dmp

Filesize
56KB

Download
memory/5264-2237-0x00007FFBE2120000-0x00007FFBE212C000-memory.dmp

Filesize
48KB

Download
memory/5264-2236-0x00007FFBE3EB0000-0x00007FFBE3EBC000-memory.dmp

Filesize
48KB

Download
memory/5264-2235-0x00007FFC07A60000-0x00007FFC07A6A000-memory.dmp

Filesize
40KB

Download
memory/5264-2246-0x00007FFBE20B0000-0x00007FFBE20C2000-memory.dmp

Filesize
72KB

Download
memory/5264-2248-0x00007FFBE20A0000-0x00007FFBE20AC000-memory.dmp

Filesize
48KB

Download
memory/5264-2247-0x00007FFBE2140000-0x00007FFBE2177000-memory.dmp

Filesize
220KB

Download
memory/5264-2249-0x00007FFBE2070000-0x00007FFBE2099000-memory.dmp

Filesize
164KB

Download
memory/5264-2250-0x00007FFBE2060000-0x00007FFBE206B000-memory.dmp

Filesize
44KB

Download
memory/5264-2251-0x00007FFBE2040000-0x00007FFBE205C000-memory.dmp

Filesize
112KB

Download
memory/5264-2253-0x00007FFBFC080000-0x00007FFBFC08C000-memory.dmp

Filesize
48KB

Download
memory/5264-2252-0x00007FFBE0FA0000-0x00007FFBE13C2000-memory.dmp

Filesize
4.1MB

Download
memory/5264-2254-0x00007FFBDFBF0000-0x00007FFBE0F97000-memory.dmp

Filesize
19.7MB

Download
memory/5264-2255-0x00007FFBE1F70000-0x00007FFBE1F92000-memory.dmp

Filesize
136KB

Download
memory/5264-2256-0x00007FFBDF9A0000-0x00007FFBDFBE8000-memory.dmp

Filesize
2.3MB

Download
memory/5264-2209-0x00007FFC06D50000-0x00007FFC06D7D000-memory.dmp

Filesize
180KB

Download
memory/5264-2289-0x00007FFBE2070000-0x00007FFBE2099000-memory.dmp

Filesize
164KB

Download
memory/5264-2290-0x00007FFBE2060000-0x00007FFBE206B000-memory.dmp

Filesize
44KB

Download
memory/5264-2296-0x00007FFBE2040000-0x00007FFBE205C000-memory.dmp

Filesize
112KB

Download
memory/5264-2297-0x00007FFBE0FA0000-0x00007FFBE13C2000-memory.dmp

Filesize
4.1MB

Download
memory/5264-2298-0x00007FFC11220000-0x00007FFC1122F000-memory.dmp

Filesize
60KB

Download
memory/5264-2318-0x00007FFBE23B0000-0x00007FFBE2437000-memory.dmp

Filesize
540KB

Download
memory/5264-2214-0x00007FFC06680000-0x00007FFC06694000-memory.dmp

Filesize
80KB

Download
memory/5264-2341-0x00007FFBE27C0000-0x00007FFBE2878000-memory.dmp

Filesize
736KB

Download
memory/5264-2344-0x00007FFBE2040000-0x00007FFBE205C000-memory.dmp

Filesize
112KB

Download
memory/5264-2343-0x00007FFBE2060000-0x00007FFBE206B000-memory.dmp

Filesize
44KB

Download
memory/5264-2348-0x00007FFBDF9A0000-0x00007FFBDFBE8000-memory.dmp

Filesize
2.3MB

Download
memory/5264-2347-0x00007FFBE1F70000-0x00007FFBE1F92000-memory.dmp

Filesize
136KB

Download
memory/5264-2346-0x00007FFBE0FA0000-0x00007FFBE13C2000-memory.dmp

Filesize
4.1MB

Download
memory/5264-2345-0x00007FFBDFBF0000-0x00007FFBE0F97000-memory.dmp

Filesize
19.7MB

Download
memory/5264-2342-0x00007FFBE2070000-0x00007FFBE2099000-memory.dmp

Filesize
164KB

Download
memory/5264-2340-0x00007FFBE2880000-0x00007FFBE28AE000-memory.dmp

Filesize
184KB

Download
memory/5264-2339-0x00007FFBE28B0000-0x00007FFBE29CC000-memory.dmp

Filesize
1.1MB

Download
memory/5264-2337-0x00007FFBE2B90000-0x00007FFBE2BBE000-memory.dmp

Filesize
184KB

Download
memory/5264-2336-0x00007FFC0AC70000-0x00007FFC0AC7D000-memory.dmp

Filesize
52KB

Download
memory/5264-2335-0x00007FFC0B960000-0x00007FFC0B96D000-memory.dmp

Filesize
52KB

Download
memory/5264-2334-0x00007FFC06AA0000-0x00007FFC06AB9000-memory.dmp

Filesize
100KB

Download
memory/5264-2333-0x00007FFBE2BC0000-0x00007FFBE2BF5000-memory.dmp

Filesize
212KB

Download
memory/5264-2332-0x00007FFC06D50000-0x00007FFC06D7D000-memory.dmp

Filesize
180KB

Download
memory/5264-2331-0x00007FFC06D80000-0x00007FFC06D99000-memory.dmp

Filesize
100KB

Download
memory/5264-2330-0x00007FFC06680000-0x00007FFC06694000-memory.dmp

Filesize
80KB

Download
memory/5264-2329-0x00007FFC07AF0000-0x00007FFC07B14000-memory.dmp

Filesize
144KB

Download
memory/5264-2328-0x00007FFC10F10000-0x00007FFC10F1F000-memory.dmp

Filesize
60KB

Download
memory/5264-2327-0x00007FFC11220000-0x00007FFC1122F000-memory.dmp

Filesize
60KB

Download
memory/5264-2326-0x00007FFBE2140000-0x00007FFBE2177000-memory.dmp

Filesize
220KB

Download
memory/5264-2325-0x00007FFBE2180000-0x00007FFBE22F3000-memory.dmp

Filesize
1.4MB

Download
memory/5264-2324-0x00007FFBE2300000-0x00007FFBE2323000-memory.dmp

Filesize
140KB

Download
memory/5264-2323-0x00007FFBFC240000-0x00007FFBFC258000-memory.dmp

Filesize
96KB

Download
memory/5264-2322-0x00007FFC07A60000-0x00007FFC07A6A000-memory.dmp

Filesize
40KB

Download
memory/5264-2321-0x00007FFBE2380000-0x00007FFBE23A6000-memory.dmp

Filesize
152KB

Download
memory/5264-2320-0x00007FFC0A6A0000-0x00007FFC0A6AB000-memory.dmp

Filesize
44KB

Download
memory/5264-2317-0x00007FFBE2440000-0x00007FFBE27B5000-memory.dmp

Filesize
3.5MB

Download
memory/5264-2312-0x00007FFBE29D0000-0x00007FFBE2A8C000-memory.dmp

Filesize
752KB

Download
memory/5264-2302-0x00007FFBE13D0000-0x00007FFBE19B8000-memory.dmp

Filesize
5.9MB

Download
memory/5264-2211-0x0000023C22E90000-0x0000023C23205000-memory.dmp

Filesize
3.5MB

Download
memory/5264-2212-0x00007FFBE2BC0000-0x00007FFBE2BF5000-memory.dmp

Filesize
212KB

Download
memory/5264-2210-0x00007FFBE2440000-0x00007FFBE27B5000-memory.dmp

Filesize
3.5MB

Download
memory/5264-2208-0x00007FFBE27C0000-0x00007FFBE2878000-memory.dmp

Filesize
736KB

Download
memory/5264-2207-0x00007FFC06D80000-0x00007FFC06D99000-memory.dmp

Filesize
100KB

Download
memory/5264-2206-0x00007FFBE2880000-0x00007FFBE28AE000-memory.dmp

Filesize
184KB

Download
memory/5264-2203-0x00007FFC07AF0000-0x00007FFC07B14000-memory.dmp

Filesize
144KB

Download
memory/5264-2204-0x00007FFBE28B0000-0x00007FFBE29CC000-memory.dmp

Filesize
1.1MB

Download
memory/5264-2199-0x00007FFBE13D0000-0x00007FFBE19B8000-memory.dmp

Filesize
5.9MB

Download
memory/5264-2200-0x00007FFBE2B90000-0x00007FFBE2BBE000-memory.dmp

Filesize
184KB

Download
memory/5264-2201-0x00007FFBE2B60000-0x00007FFBE2B8B000-memory.dmp

Filesize
172KB

Download
memory/5264-2202-0x00007FFBE29D0000-0x00007FFBE2A8C000-memory.dmp

Filesize
752KB

Download
memory/5264-2196-0x00007FFC0AC70000-0x00007FFC0AC7D000-memory.dmp

Filesize
52KB

Download
memory/5264-2192-0x00007FFC06AA0000-0x00007FFC06AB9000-memory.dmp

Filesize
100KB

Download
memory/5264-2193-0x00007FFC0B960000-0x00007FFC0B96D000-memory.dmp

Filesize
52KB

Download
memory/5264-2189-0x00007FFBE2BC0000-0x00007FFBE2BF5000-memory.dmp

Filesize
212KB

Download
memory/5264-2168-0x00007FFC06D50000-0x00007FFC06D7D000-memory.dmp

Filesize
180KB

Download
memory/5264-2165-0x00007FFC06D80000-0x00007FFC06D99000-memory.dmp

Filesize
100KB

Download
memory/5264-2161-0x00007FFC07AF0000-0x00007FFC07B14000-memory.dmp

Filesize
144KB

Download
memory/5264-2162-0x00007FFC10F10000-0x00007FFC10F1F000-memory.dmp

Filesize
60KB

Download
memory/5264-2134-0x00007FFBE13D0000-0x00007FFBE19B8000-memory.dmp

Filesize
5.9MB

Download