hxxps://github[.]com/Vaquentt/Nightlight

Analysis

max time kernel
154s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
01/04/2025, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Vaquentt/Nightlight

Score

7^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏ .scr	nightlight.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏ .scr	nightlight.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏ .scr	attrib.exe

Loads dropped DLL 56 IoCs

pid	Process
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
272	discord.com
289	discord.com
44	raw.githubusercontent.com
48	discord.com
140	raw.githubusercontent.com
246	raw.githubusercontent.com
247	discord.com
260	discord.com
288	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
140	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4776	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001400000002b8da-2754.dat	upx
behavioral1/memory/4328-2758-0x00007FFF448C0000-0x00007FFF44EA8000-memory.dmp	upx
behavioral1/files/0x000700000002ae15-2760.dat	upx
behavioral1/memory/4328-2766-0x00007FFF58840000-0x00007FFF58864000-memory.dmp	upx
behavioral1/files/0x000600000002ae36-2767.dat	upx
behavioral1/memory/4328-2768-0x00007FFF5C8A0000-0x00007FFF5C8AF000-memory.dmp	upx
behavioral1/files/0x000700000002ae13-2769.dat	upx
behavioral1/files/0x000600000002ae18-2772.dat	upx
behavioral1/memory/4328-2771-0x00007FFF57A30000-0x00007FFF57A49000-memory.dmp	upx
behavioral1/memory/4328-2774-0x00007FFF4DB10000-0x00007FFF4DB3D000-memory.dmp	upx
behavioral1/files/0x000600000002ae1e-2792.dat	upx
behavioral1/files/0x000700000002ae1f-2793.dat	upx
behavioral1/files/0x001400000002b8d8-2778.dat	upx
behavioral1/files/0x000600000002ae1c-2796.dat	upx
behavioral1/memory/4328-2797-0x00007FFF4DAF0000-0x00007FFF4DB09000-memory.dmp	upx
behavioral1/memory/4328-2795-0x00007FFF45830000-0x00007FFF45865000-memory.dmp	upx
behavioral1/files/0x000700000002ae1d-2791.dat	upx
behavioral1/files/0x000600000002ae1b-2789.dat	upx
behavioral1/files/0x000600000002ae1a-2788.dat	upx
behavioral1/files/0x000700000002ae19-2787.dat	upx
behavioral1/files/0x000700000002ae17-2786.dat	upx
behavioral1/files/0x000600000002ae16-2785.dat	upx
behavioral1/files/0x000600000002ae14-2784.dat	upx
behavioral1/files/0x000600000002ae12-2783.dat	upx
behavioral1/files/0x001400000002b8e9-2781.dat	upx
behavioral1/files/0x001400000002b8e8-2780.dat	upx
behavioral1/files/0x001400000002b8de-2779.dat	upx
behavioral1/files/0x000700000002ae37-2776.dat	upx
behavioral1/files/0x000600000002ae35-2775.dat	upx
behavioral1/memory/4328-2798-0x00007FFF5C540000-0x00007FFF5C54D000-memory.dmp	upx
behavioral1/memory/4328-2799-0x00007FFF5C390000-0x00007FFF5C39D000-memory.dmp	upx
behavioral1/memory/4328-2800-0x00007FFF45800000-0x00007FFF4582E000-memory.dmp	upx
behavioral1/memory/4328-2801-0x00007FFF448C0000-0x00007FFF44EA8000-memory.dmp	upx
behavioral1/memory/4328-2804-0x00007FFF58840000-0x00007FFF58864000-memory.dmp	upx
behavioral1/memory/4328-2803-0x00007FFF457D0000-0x00007FFF457FB000-memory.dmp	upx
behavioral1/memory/4328-2802-0x00007FFF45640000-0x00007FFF456FC000-memory.dmp	upx
behavioral1/memory/4328-2805-0x00007FFF45520000-0x00007FFF4563C000-memory.dmp	upx
behavioral1/memory/4328-2806-0x00007FFF57A30000-0x00007FFF57A49000-memory.dmp	upx
behavioral1/memory/4328-2807-0x00007FFF454F0000-0x00007FFF4551E000-memory.dmp	upx
behavioral1/memory/4328-2808-0x00007FFF4DB10000-0x00007FFF4DB3D000-memory.dmp	upx
behavioral1/memory/4328-2809-0x00007FFF45430000-0x00007FFF454E8000-memory.dmp	upx
behavioral1/memory/4328-2812-0x00007FFF4DAF0000-0x00007FFF4DB09000-memory.dmp	upx
behavioral1/memory/4328-2810-0x00007FFF44540000-0x00007FFF448B5000-memory.dmp	upx
behavioral1/memory/4328-2813-0x00007FFF453A0000-0x00007FFF45427000-memory.dmp	upx
behavioral1/memory/4328-2814-0x00007FFF5C390000-0x00007FFF5C39D000-memory.dmp	upx
behavioral1/memory/4328-2815-0x00007FFF45380000-0x00007FFF45394000-memory.dmp	upx
behavioral1/memory/4328-2816-0x00007FFF45800000-0x00007FFF4582E000-memory.dmp	upx
behavioral1/memory/4328-2818-0x00007FFF45350000-0x00007FFF45376000-memory.dmp	upx
behavioral1/memory/4328-2817-0x00007FFF596B0000-0x00007FFF596BB000-memory.dmp	upx
behavioral1/memory/4328-2819-0x00007FFF457D0000-0x00007FFF457FB000-memory.dmp	upx
behavioral1/memory/4328-2820-0x00007FFF59270000-0x00007FFF5927A000-memory.dmp	upx
behavioral1/memory/4328-2822-0x00007FFF45330000-0x00007FFF45348000-memory.dmp	upx
behavioral1/memory/4328-2821-0x00007FFF45520000-0x00007FFF4563C000-memory.dmp	upx
behavioral1/memory/4328-2823-0x00007FFF454F0000-0x00007FFF4551E000-memory.dmp	upx
behavioral1/memory/4328-2824-0x00007FFF452B0000-0x00007FFF452D3000-memory.dmp	upx
behavioral1/memory/4328-2826-0x00007FFF450D0000-0x00007FFF45243000-memory.dmp	upx
behavioral1/memory/4328-2825-0x00007FFF45430000-0x00007FFF454E8000-memory.dmp	upx
behavioral1/memory/4328-2827-0x00007FFF44540000-0x00007FFF448B5000-memory.dmp	upx
behavioral1/memory/4328-2838-0x00007FFF452A0000-0x00007FFF452AC000-memory.dmp	upx
behavioral1/memory/4328-2837-0x00007FFF453A0000-0x00007FFF45427000-memory.dmp	upx
behavioral1/memory/4328-2836-0x00007FFF58AB0000-0x00007FFF58ABB000-memory.dmp	upx
behavioral1/memory/4328-2835-0x00007FFF4CC80000-0x00007FFF4CC8C000-memory.dmp	upx
behavioral1/memory/4328-2834-0x00007FFF51FB0000-0x00007FFF51FBB000-memory.dmp	upx
behavioral1/memory/4328-2833-0x00007FFF58610000-0x00007FFF5861C000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\fi\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_762885378\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1348_170841885\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_762885378\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_762885378\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_94381340\page_embed_script.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4708	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2140	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133879979585070949"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1216697136-3907990103-1733992739-1000\{E4F21AFF-7878-4375-8B35-033E7D768566}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nightlight-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
4328	nightlight.exe
1468	chrome.exe
1468	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	nightlight.exe
Token: SeIncreaseQuotaPrivilege	3552	WMIC.exe
Token: SeSecurityPrivilege	3552	WMIC.exe
Token: SeTakeOwnershipPrivilege	3552	WMIC.exe
Token: SeLoadDriverPrivilege	3552	WMIC.exe
Token: SeSystemProfilePrivilege	3552	WMIC.exe
Token: SeSystemtimePrivilege	3552	WMIC.exe
Token: SeProfSingleProcessPrivilege	3552	WMIC.exe
Token: SeIncBasePriorityPrivilege	3552	WMIC.exe
Token: SeCreatePagefilePrivilege	3552	WMIC.exe
Token: SeBackupPrivilege	3552	WMIC.exe
Token: SeRestorePrivilege	3552	WMIC.exe
Token: SeShutdownPrivilege	3552	WMIC.exe
Token: SeDebugPrivilege	3552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3552	WMIC.exe
Token: SeRemoteShutdownPrivilege	3552	WMIC.exe
Token: SeUndockPrivilege	3552	WMIC.exe
Token: SeManageVolumePrivilege	3552	WMIC.exe
Token: 33	3552	WMIC.exe
Token: 34	3552	WMIC.exe
Token: 35	3552	WMIC.exe
Token: 36	3552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3552	WMIC.exe
Token: SeSecurityPrivilege	3552	WMIC.exe
Token: SeTakeOwnershipPrivilege	3552	WMIC.exe
Token: SeLoadDriverPrivilege	3552	WMIC.exe
Token: SeSystemProfilePrivilege	3552	WMIC.exe
Token: SeSystemtimePrivilege	3552	WMIC.exe
Token: SeProfSingleProcessPrivilege	3552	WMIC.exe
Token: SeIncBasePriorityPrivilege	3552	WMIC.exe
Token: SeCreatePagefilePrivilege	3552	WMIC.exe
Token: SeBackupPrivilege	3552	WMIC.exe
Token: SeRestorePrivilege	3552	WMIC.exe
Token: SeShutdownPrivilege	3552	WMIC.exe
Token: SeDebugPrivilege	3552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3552	WMIC.exe
Token: SeRemoteShutdownPrivilege	3552	WMIC.exe
Token: SeUndockPrivilege	3552	WMIC.exe
Token: SeManageVolumePrivilege	3552	WMIC.exe
Token: 33	3552	WMIC.exe
Token: 34	3552	WMIC.exe
Token: 35	3552	WMIC.exe
Token: 36	3552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5728	wmic.exe
Token: SeSecurityPrivilege	5728	wmic.exe
Token: SeTakeOwnershipPrivilege	5728	wmic.exe
Token: SeLoadDriverPrivilege	5728	wmic.exe
Token: SeSystemProfilePrivilege	5728	wmic.exe
Token: SeSystemtimePrivilege	5728	wmic.exe
Token: SeProfSingleProcessPrivilege	5728	wmic.exe
Token: SeIncBasePriorityPrivilege	5728	wmic.exe
Token: SeCreatePagefilePrivilege	5728	wmic.exe
Token: SeBackupPrivilege	5728	wmic.exe
Token: SeRestorePrivilege	5728	wmic.exe
Token: SeShutdownPrivilege	5728	wmic.exe
Token: SeDebugPrivilege	5728	wmic.exe
Token: SeSystemEnvironmentPrivilege	5728	wmic.exe
Token: SeRemoteShutdownPrivilege	5728	wmic.exe
Token: SeUndockPrivilege	5728	wmic.exe
Token: SeManageVolumePrivilege	5728	wmic.exe
Token: 33	5728	wmic.exe
Token: 34	5728	wmic.exe
Token: 35	5728	wmic.exe
Token: 36	5728	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe
1468	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 3556	1348	msedge.exe	78
PID 1348 wrote to memory of 3556	1348	msedge.exe	78
PID 1348 wrote to memory of 4140	1348	msedge.exe	79
PID 1348 wrote to memory of 4140	1348	msedge.exe	79
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 5536	1348	msedge.exe	81
PID 1348 wrote to memory of 5536	1348	msedge.exe	81
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 4100	1348	msedge.exe	80
PID 1348 wrote to memory of 5536	1348	msedge.exe	81
PID 1348 wrote to memory of 5536	1348	msedge.exe	81
PID 1348 wrote to memory of 5536	1348	msedge.exe	81

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1152	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Vaquentt/Nightlight
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7fff591df208,0x7fff591df214,0x7fff591df220
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1816,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2128,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2612,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3468,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5132,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5084,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5584,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6204,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6976,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6924,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6796,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3644,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7308,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7476,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7596,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7376,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7300,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7184,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=5244,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=3972,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7668,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=6364,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=760,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6152,i,189942453291076854,3948102903777407653,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  - NTFS ADS
  PID:568

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3720

C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe
"C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe"
1⤵
PID:2192
- C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe
  "C:\Users\Admin\Downloads\Nightlight-main\Nightlight-main\nightlight.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏ .scr"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4776
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‏ .scr"
      4⤵
      Drops startup file
      Views/modifies file attributes
      PID:1152
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3552
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4028
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1968
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    PID:3052
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    PID:2420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:2972
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5902dcf8,0x7fff5902dd04,0x7fff5902dd10
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2072,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4196,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4212 /prefetch:9
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4696,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5268,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5532,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5336,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5344,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5644,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5556,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5808,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5428,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3336,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5956,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4768,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5780,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5684,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4688,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5900,i,696512244127267340,16930112563805496523,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4324 /prefetch:9
  2⤵
  PID:5936

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9a186fb5-f62a-4c2f-b7f9-930aa15ebc80.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
cc472a54cc4d01c255ab669e65afec75

SHA1
744310ee361c79179d24318e3c22d9fd8e7ab5c3

SHA256
fc7ed36a228f32a617f10692507bb097cd21f8f488e9edb098b6ea2b6b12ff44

SHA512
dc51ead776c47cdfe01d7f8ea69ede571af2e95104624f4d5d8523d88c6dfb9a29f23f1a37525d213bd24efa2a4ddab6300f213df399bb0bb5194cbe003e9df2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
04f577b88ff66bb37643e92f797949c5

SHA1
4e7e7194ce8abec34a356577c62e15634280a52b

SHA256
80dee836b52a8f2635a269688af3065985b47a605dd34a2c675c852ca5255722

SHA512
e208b817c06808f986b8bf07388831e1074d791de2b5fd5e3da35abb35e014d98ba1db818cd124bf30de3dc8c27a01dcbce6c62e30f5ffa720854b2bd6772074

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
18ce72b303b3368c761a5c7ee0ecc045

SHA1
7362e1a57c4b4ce3b0c3ab8c92f1916667ab5966

SHA256
32af911d4104a9efab78b075cdc8900497bef8dd6de783b4ab102da2ab6b695f

SHA512
d71427fbdb34db843bd1b238a5eff464253173006552de9e8a70ff56a99d7e04e029be65fb3728913c99ab43a8a8b014a7ee4d13c8130f1757ccff7b22208ab2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
900dbca8223f7f3d7f01c7a87bf3a19d

SHA1
91fa76561d76f026ff3f52525c5d45d704330663

SHA256
90857b4fcd9a839dae61a6b09716d52573ac4bcee46dedc71f73a2d42c87ee8d

SHA512
9cf57e0f00a60242b2cfc035f6ba82918625df088b7fc92faad57744b6da4a58da2f9726a04fb1f010323990664955d8442126ee490e24ce2c732f95dc9cd30b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
c2c1310d2045d2ef24a7fbf07a37e2a0

SHA1
e7dc95b7b0c6f890967bd9043d26856a42bbe195

SHA256
c30541112dbac03c5706e0139ce2615bc25d5477c1ad7170e177265289223ff5

SHA512
08658fe5b40366b7e437d525d5d12a2aad1423e87e18a0b4cd73c208a2dbe4833e92a02b6886ce67da8791f48384beffd324fd1ea9c6e2b9bc5b71398002bdd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
344a4f30e4709c3dc28463b8f77b6ab3

SHA1
d1732b06a268eaf22e6edaec67f064929ef7eccb

SHA256
74c8d2995ec50ba3eb4bca63f69dd5b7df2d6fcd7a463175f7d1cc104a1dfebb

SHA512
fbeb4205f24f6aa1bbd55e6513ae5ecbb32e6a25a082629af13e87c0efe4a5bffc5dcb4cb9f21abae2fdb9575dc4fddff940a789d5cf94e034fdcbe6a0dd8a11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a791.TMP

Filesize
48B

MD5
12677a4f0fdf4bbbc8959ab966c68ecc

SHA1
fac3ef76f73c3e56c28bc406230edaf0e6e52b65

SHA256
cee5b4d0f6cfd23dc8ce22a63ccd343e1a57250c5361ffbe16950dd2235d2d6a

SHA512
109596b84de6e36926a612b4c5dd76a182abda32eafceb2d89839d5c0dfc828fc7e4abc045bd71271d5f3bf3b67b900132d6d0d5a4fdfc8415fac298a860db77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
db683194bbf725a398279bb51d1d4684

SHA1
c036ede45837f764d83922dd00622d3e6e9b586b

SHA256
47f04dbcf483e4f95ea03c6e649533576dd3f3dbaaf7c423ebe3e6537aed2a33

SHA512
e80657ddced6b4fd414501b982bb7f9df8f8c816c001cfad7f7f5b7c3d3083d036eba65983a27bfd7cc2c1542701d010f172d6926f2d11f98a7b0b4c009adf82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
47bdb822e10c6975c98e5813dda02fb0

SHA1
87085c8e7dadfa29ff34024dcdc2a2ed78f8bbc3

SHA256
f321b1fb52662cbee3d67493718a2e33bc86dcabef9b9867e3ce65a369b6c08b

SHA512
27a42f620ad2468a801761d48d53b8f90bc481a759a607c754ca110a546ee897b56486449413a2bf43341622dff65e09552c483269157bf2b0128c59a409bfdc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
12d8ac98085481dea06797d94b315957

SHA1
d13f2289bfc58165c04e97a35d62ee77324a5f1d

SHA256
a1fc87fff91bf7a6d6bbd7a2890145cafdf692d3cef80e5e37865262801ca442

SHA512
da4f6f9086d071aef3c941aa75729ad785a61bf72b48cbedd7a14afb1c0fddaf959acb0a549b4281e5efdd7d158b6f0ffc459fef5ed1239b0f6b5a8270f3cbea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
ae987eb15fd5136f2fa707a7b1f18abb

SHA1
bc4aa67ba8692031bfead4b653fc6fefaee3dbbb

SHA256
f5e0e4ee660e95e1c4f64d5aa134aacf9f7fa1a9b9cfaad10f5b57b24d331d1e

SHA512
fb98d55c498ab80b1f7886b56d0e652e648666bfb13c61c20d495dfb9f2e473e24821efc48f103fb0705e199e56b3e23a0bca82c0296d690104eb0d79032c0f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
b588210556d751f224493ead6bd5621a

SHA1
6477a83443436d2398a2e84eeaca1b2c147471ce

SHA256
a82e2d04dc3fadf688d99397e1b88c5548d34f8fd105923508f6093180f33d73

SHA512
fef8e1a2388196f8f513bba62655e8be24d70b1cb02073ab10e8be9369314d044bc785b246c6aea2543c317b31c170424e298526bb5959ac17ba9868bb7a2d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585d1f.TMP

Filesize
4KB

MD5
32003de18c0e5a6a3599174ce561625f

SHA1
11b238776db34f4104e7c15395b48861cb60c0f5

SHA256
9ce99010e9b38a4605f9b50bae0c8a168e44e1c66b1cadb0bcb19c17b072861b

SHA512
f3facc01165ac0ebf843c86249ad49220475b8167879b93877345e37c565af7035f7c688551cc0c4c53730bd429e9f95d48ef6433036d297796c689270b5a66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\75fc8dbb-6284-4197-97de-a7033d10b058.tmp

Filesize
1KB

MD5
1810a7bd3c1119d79a69ac52e1aaa5b7

SHA1
63455eb07bc5aa07bead304b110018bdcd181fa2

SHA256
876158d024e4db6ae62ff02f797216463b2e8a66c59c5892e9d8e039fe7ef4e9

SHA512
168351a0f950b2479b9efeca8ca4ccbb7633699f6935cffd959df7970cbf7c820d6c7ee7cb0277f0429b16328eed5e22dad6a8a2a8f98743a2d8995b191459c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b0770dc9356f6c46814db7c0ac399723

SHA1
7c85aa580c70181d05c3e6d7498872659ba16cce

SHA256
50bc8dfb862c64f5d0d924212d031e3c67096be7933ac9dc5fc93f9ad1b0164e

SHA512
4460f6323ea1c543d62760614f29261dfc8b2c1f85011ef2eaa8e47ca63665807c4331c2c102632ea739b22e0c398c9f0964a37634e3085c5d0a213e21e1e00b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
afba1b8525e130a2b7a35100714418b0

SHA1
01ac941c794c9c3536740f495e7e9b14e7086bbf

SHA256
355bd9d9ae6cb7e439611aafa7bb2098312052e664105cd992c8daf4f52d796d

SHA512
68873c14c6de2415ba0a7103d58a44123d07a5f059340dbaccb4141c9fe437b5b9bcebe24382675953ee6dc8a2e828fbfd1dae36a204bb94ba3c7db28f26fc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
5822e0b5c941353c9ad64a2d88315a16

SHA1
8945e7fe5bea1155777ac31af51cbd9f336a096c

SHA256
8f4e1e284f689b818ecd09f8e2b0fd68ac4f81487ddd86bc6671ec64f3844491

SHA512
b4078b1da4b10c8858dd311a8aa3e7903ae5fa5ce0b9ca9eebdaf909acfbbc0fcb8ef6f7e4ccc0ae10cdbed0b8c3270d181ac6db9524d80cee17d2dff09fc909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
9c05bca8d7289f361b17b9f192e1bdf4

SHA1
4b448b855567487c1c3921b0a72baf4f88927a2a

SHA256
53f6202e7fc98aff1d176becd8a739e6fb46ff752888961f2466576506b30374

SHA512
d6e2eeab4eb005581b17a6e756675e8a78c9965c6dc4e8a0814a1078545b837787c9b3c50a82ea826e1582edacedd3c16b45d7aa16fdc7d299992db570525f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
f36974affbe386981fd14ec1f0ecfcd0

SHA1
172449eebcf2d86b1f165bd43e3ee57a2a249a0c

SHA256
ec800317c5486c70a9cd897bfa6c39677e86ac4bf70af969644e077138341981

SHA512
4f8305456c0a1a14b237df9c73a31a94c059ad86458fcfdeb140f68e0b90ea5e3986147eb2e905f51cae548e78be0865bb897e011064e3fda0437c72ee7f5c26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
336cf198384a7244ed500f83051b5cd6

SHA1
814fe73c6a63dc30db75e38155cc3759d353c291

SHA256
7ade9f09add7941546b2f8513150dca710c489c1fecc2cd8d777523e64b1df01

SHA512
5a1e059bf2beb696adb2baabd0f5f69b6fa05f912c69c313d882e2b8b6d5dd2569a4bd937f7b1f4794f8f6bf2b780df152b4402c9764f8c32f2b4bdd0f944bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0df5c405-bad3-41d5-b7a7-3b778b36f721\index-dir\the-real-index

Filesize
72B

MD5
3c0ff8ce38e979b76f9e0fffe3403ff2

SHA1
7ebb9a3455509a72354fd1cab9d5096f20284bc5

SHA256
21103ddb5549dbefcf8c89c4e6ff80f853b73d0a7c50a3ff5b81cb8cb06e6693

SHA512
2dfd04bc7453f0578e379dbd942429e6536e8e6dfe5bf7069ad9c7c01a145da42b531e11633498a12caf26a6c00cbdbe4b84ed0ede419b99b56e717fc7effda8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0df5c405-bad3-41d5-b7a7-3b778b36f721\index-dir\the-real-index~RFe585138.TMP

Filesize
48B

MD5
9313421e20396b59d859b81485ad4c2c

SHA1
195e84df5d2e563db35510994473c8af4f3efc19

SHA256
4c23b5f32d15dd5f450f21adf8fc035382b221d1a5208e6381151f518525d903

SHA512
1006cca68171dc638f2b7d86cafad5bb50d992d961cd0b377dfc1fe002999cdca75d1b804434288002b761264bb939d16b04001d9728f8c73af38523ed4a410e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b052dc4a-0678-4bfc-a777-f10a0592702c\index-dir\the-real-index

Filesize
2KB

MD5
829d618c45ecf83e8b5a1d6af665caac

SHA1
f1913247845b8e5fbd4ce42264938571a008ad46

SHA256
757e9072f9bcb2e4b588d1383f0e8e856ae6a19dc86c54dd9fb7587af20c8180

SHA512
40b4312ba19344490f7ecb9543d61923799d79d19efe957aeb856aaec9c4efb685a1157d4320edb869e2b366099b3006a50151d50f5e31f28c1dfd4039176f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b052dc4a-0678-4bfc-a777-f10a0592702c\index-dir\the-real-index

Filesize
1KB

MD5
66b84ffe68c86e9a5bfd09f3f8d8f084

SHA1
aa1cf99bbd860c2748d71c4d5eb4172a4ee8b432

SHA256
62c80cbb9d2a29e5a4730791d0f3f6ffdaa394b0bda4ea453dcadcc240973166

SHA512
ec36d13ceb01bfef24dd253bb144dac93afd02109665d60dfbccc7ec03f7f2c1001c18c6ea6b662f3b948cf670a1cc3f8a4f30e46f86a1c58dd49cd5dbe8a9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b052dc4a-0678-4bfc-a777-f10a0592702c\index-dir\the-real-index~RFe57c459.TMP

Filesize
1KB

MD5
63625096af622f09f60b707033db4ff0

SHA1
21f9dd7cccf8f46c09f0e75e84bb6a8f69f8882c

SHA256
d8ae757d3d94df525a4f1176a322bb7df109bb7997e053ee6158c7e12144ae13

SHA512
69f255351a24e487699035e58155e37279b8749331ffbc51318aa15471eddc7306b09340f31b03a2093a607f524c24626efec3911b349809125466e2d1791a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\da1264a6-fd89-448e-9c6e-1c1577262c5b\index-dir\the-real-index

Filesize
72B

MD5
e5df3937e7b9545a408b1a1055d80512

SHA1
035225d50cb651efd35c5cf80d3b326970c26d36

SHA256
4ea6304364496ea91cff843e73ff72b75fc8e0b3d1d8fe12c0fd6bfeab98a603

SHA512
13b55d16fe0d471499a9302ba9369c354d2054bcf6d1a08e0255c7d84ba4af131a61c2299c641df923becb064c5b9d75f4829cb72a9da21f2536d0a51f5840c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f374c807-02a5-4723-b955-071c984fdc10\index-dir\the-real-index

Filesize
72B

MD5
9f3e6e5c7376770c574d2d4f63f25576

SHA1
42b6c8f5ca662127b79794fcf5bab7ab6c84cdab

SHA256
a9e9600a5e2460830ef40add6d31bdb19997ea27f0c613cbd49592f2c123ced6

SHA512
851fb36886e6e81f2079d98859e1eb68923fa724850b6ee930ee1955aa53a6facb2e92cb5aa6939e766a35ee54c1fbdb9aa511b5ce70de3439b48cc43781be88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f374c807-02a5-4723-b955-071c984fdc10\index-dir\the-real-index

Filesize
72B

MD5
bda7b2875c5b5062cd7e07f3bd2615e3

SHA1
a7841694307403ce3366f423d4ca0c252ab36da9

SHA256
6cfa6737da1a37cdaa34a9f6d1b68534dea294028079c94376717ecee7b3bd97

SHA512
f32c0cbd85f30841a1e4bb3500db4c3faee18be29f92c902b342f4f265ec2edc88e886ab952c91d82a7fb9d072e2ee82c4c9738a122d9cb5b1b87fd20c766637

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
407cd949289dca75cf143c933537d621

SHA1
4763c4646c2f59ea205e7367ccf9764f8d649733

SHA256
de9d233e7e173a99f43ad7de46c269767aab8651503a16881ebe0b1334a0fed7

SHA512
82d87c7add3ac341f64314cf88050cc2647e9f4ca918df3de9ec6020f8f3b08a3e7d5a6a38fa3399778ced6d1533acacde0352bf2ef41db4a315407219fb4998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
301c7dac167091dac48fe5bc6c29d78e

SHA1
27fee202d8547ae1b86aacb9e17e411f64cee9f2

SHA256
fd83de2b7fa274cfadd13db2f99de07100aa542cd9845cd34b3f0d67973839a6

SHA512
9a80759df16a319344703ca928c5788d035d31fe34be4792eeb5d1f13d4227d4bc45b99f740d12f4119ccce0bf2064c680618ebefef4c1376d0e38e9ab089e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
99792ea545c96778f365766261aa8d86

SHA1
1444f6228dfdfbb659b2b1c18d9c53b694a75bdf

SHA256
98135c64873d527c36014ecbdba554d92e0fd698433330557b10657150f01b01

SHA512
596f4abbb0fc6fc32dd1125895e876f24be7e91fefbeef9bda9f3a973835c1c159f2596904db644f949649f3760c09587c44a2f21bca0ac70052f2eb04f0bd32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581d57.TMP

Filesize
48B

MD5
7e2654e77851a6bf879d834ffea00716

SHA1
9f455b2396feeb6719a274b95fef62f3e3b4fd98

SHA256
8dbebfcfd21d5b4763ab8ead2fd32af5bd3b8fcf9d600b414ef06e2880fa1318

SHA512
22daecb5e9b944a58fca977d299337ceaf876ce0ac9c9d3ca07151274ca6dd00cef5ee5c443af23254ba060687590093cb61d0773b6840ee6279cd92b8ad8b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d9ace5ee3da5ba75fa15838c1119b8bb

SHA1
7018451c82d9dd7bc3c62533e968055f86012773

SHA256
36e16993207110c517fa59083f04dc100f69fab23caaa1a58bf0191a90213725

SHA512
b9fb27ad182c0fdf7e2246414067a98d44bef3e4c722f2e7fbfd7c9cf015b6d12444f85950a63a1885c70c1e035945158cb30ea33c8b43b143a1b8ede0df843d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
c85c3f5b81ebe704531dd4ba52212854

SHA1
4be2ec40e45cc18ef854f277502ac5ca3ad6d046

SHA256
909a4d72cd930d531eae2149b84f4d3dc25f26fa5cb3a7b9db08dbf09407e358

SHA512
9db73578f87c926460f3beedf5a3732410d581ef137aafe5fba5286a79a64121ad02192fddd81658b0d93780a57441fecc3b92852a3b266801a65169c2352141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
f7e0b2361bd7809a50255bcaec8a0103

SHA1
8210b5bbd6a848d177323bc41ccd6f752c9f0f7a

SHA256
a43c85323205899d34ecd1329eabbe306b10566583ac4a1badbcb4c83e83fcc3

SHA512
b24eca794abb2798d74628037a8f138262070dbb284342704837f19e793867816684788431eac0258642d18d512db3b847571747349e21af560a458fffeff20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
d4f8d6b660ac83befb2e638e4ad6e0d7

SHA1
bdf43165c1b4b014212425c123bfa4731c8dd16a

SHA256
58c5cc18359cbc215bfffe84a4a732159496bb47a5f19948715c5d50defc3670

SHA512
d7bf86de7b5223768e9e5970ba50c105538ff158aa8cdd22487877e4fe906b6838e8ec0520a10424c61024e3e03d664f141376f9aa2aeb13502be72aebf01194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
5c196ad9f010a406708647bc67525cf3

SHA1
962ac3bfcdf5c37cf91bd0dce6b807772bb844ed

SHA256
b54ca2a82b2ea734f2908cc1959e51e134be84d8c7f4255960049fdab7a6c444

SHA512
024508193c7427ed4a1c1d086733a02f5db1b2f80d8599348665757e885f07693b100e59f9d8430065f2b6715552c4046d4c35e4e41ca395019a2082aa607a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
d6b6c6226b2552543d0f688a610c7121

SHA1
43062e808ec3b0714253184e7959c875a00fbb0c

SHA256
8f3933cb2fb5c7378208ba808dfc14cc1c325357b957d25fee630cc28f8cfbd6

SHA512
6acf79b30988c0061e2fbbcbed8b3de2c8ae0cc2f52e28b32cd1fdd1ed4a3aaa1f0f972f9c9a1ab7845850f98153dbf5e19c63256ee45e7eaf1b919e17fdd97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
873f654d5466adcc8d4670863a3a7cc4

SHA1
e48e3d7083aeace87e7b7e4616b4f85821bd592b

SHA256
e6cdeee0c534fe9a63b6e0dc254a445657ad0c8634a17fb0a34f4d2efc696ca9

SHA512
15ec3437133ef6fc66cea906849a70b1815992d5ed1b8a975acb939adfc1859918afb02c7eb1a7522cbb728fe4f8e9ba2e3dd0700d88d33c279141711e5e7418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8a66b7ad4bfd5e5025bf1d8d9626d6a9

SHA1
99794c0e71b3448df6170ae1fe456384c22bf2cf

SHA256
95d0175e2bd97d4043053e6e49152f4c14b4bc28fdf6e1462c09d646d04b2593

SHA512
5410ea2f6b9174eb0addb4f54bb97e94b1cc36c76c629a756948fc1e397651dad510e8ab54d1d2865df7987861fe2eacda06c5daaa61ae3faacb4ea856264662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
21c15cdee848fb0385e9ad54a7d773bc

SHA1
b5ad063dc3fc848a1e7de77c07af7c54888280c7

SHA256
13cc3662622be4e33ee28244ad91d856e182a92a92758f5d43221ee8d66268d1

SHA512
c97e87a3027ae08f3a99bb82c7cf5c241bfa82d1fe4a1fd33dc5bb55a86ddc5eeced2e2d52837fb2f036e2676b91aed977ba8acaa643c32815b407729342def5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
d763f43f828faeffbdc86c93fda59ee6

SHA1
6edacb655f2fdb9e99b93b69464e43ab8e686b38

SHA256
6211cbc349068e7d9815cc9ec817d1e933b5993636a670d3b7df98d7e3dad457

SHA512
fe03af20a38d86269cd36d7835ee34ebb8213dd5a70b1d4ffb1e47f32e09df5ef2c9d287b3a59f5e91db8bf6c341b2df3b457a7f7accc7e2773fec1e009400bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
0c22caf0e1ff99b995cbe4fa35fb0712

SHA1
bd3356a697668d60b257869c929245875a67ab33

SHA256
90f8b68349e1af6d7b005e08d405e3baff465ed03e3f4a35a697e3592a893b2f

SHA512
87f1fb19bb149534eaa889b477a5f3f8346ad5a9a3fc506e4177fc1e04db618d4948d1fcd64b655ca27952433037e7d0804ec9d513e3fd21eae181fb02b690e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
bc93705aaf17a49f996de8e6431a1ae2

SHA1
0378ed44094a4ba571cb194b02dd54bf70e53d3b

SHA256
8e668381d8258814c33e412338c0f75e1a9e82d88b1d6f941be27330954c936d

SHA512
aa576d1225d0b9efccd8c9612ad0b6b7a171b7af61b7c34929f5f807ed0e1bf0044f0b9a0ff1399ce866099f3f76e5c59889b87de3988515b6c159cd78c36c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57fa2f.TMP

Filesize
392B

MD5
0dbd38757e1864e7dd926778ef1ca356

SHA1
caeacd2270b3cc583ea628601ed8ed6ae592356e

SHA256
97b4b248232bbb939fbd019ab0d34e2eea49af1f3710db42e88c67c0c061244a

SHA512
f990735ddba929bd5d3ebf1340b61ac3289a67f63caaef67ab482ed61cb5ffff35b80d9b50267299e9ff3024b4bf41f3b08513c40c39b6b49df6f42bba925c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\MLeFSiL7VQ\Browser\cc's.txt

Filesize
91B

MD5
5aa796b6950a92a226cc5c98ed1c47e8

SHA1
6706a4082fc2c141272122f1ca424a446506c44d

SHA256
c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c

SHA512
976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_asyncio.pyd

Filesize
34KB

MD5
936e44a303a5957709434a0c6bf4532e

SHA1
e35f0b78f61797d9277741a1ee577b5fe7af3d62

SHA256
11f1062fafb4fbca92e3b2cef97ab66ec011142f5b0312e74815decd93be458b

SHA512
cebe905b718825c1841e9c0e83dfdac95d0ff50b116ab3b91b05ca21f86f1482f5b1e13988c969244c644d17bd378792ac4967caa721f0b0e858cd92859af154

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_bz2.pyd

Filesize
46KB

MD5
af3d45698d379c97a90cca9625bc5926

SHA1
0783866af330c1029253859574c369901969208e

SHA256
47af0730824f96865b5e20f8bba34b0d5f3a330087411adba71269312bf7ccec

SHA512
117e95d2ba0432f5ece882ad67a3fbf2e2cd251b4327a0d66b3fffd444e2d1813ddb568321bde1636b4180d19607db6103df145153e4ff84e9be601fd2dd5691

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
f5a0e3f73ad4002839a85ec9b5285cc0

SHA1
2657e49964491d8b0784ab6ae157c767cf809673

SHA256
34dff4546abf4cd9d1e605f215339e6816c3aa4ef3c6028afcf00cb6241dbccf

SHA512
81d683f45b6ea1b48d0e377779c9b87ddff5b8549f00ae375ebe617fbd00d0149639a2b5c1b42ea536bde786aea50025646311b3de243c48ed192014dcc9974b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_ctypes.pyd

Filesize
57KB

MD5
2346cf6a1ad336f3ee23c4ec3ff7871c

SHA1
e36b759c0b78d2def431aa11bcbb7d7cf02f1eea

SHA256
490a11d03dd3aeb05a410eb0d285e3da788e73b643ea9914fffd5a2c102dc1df

SHA512
7a92de4937b23952e2a31bb09a58b2ad81c06da23704e4b4f964eb42948adad1a1e57920c021283da1b7154e7ac19e46031ffee6b69a73acbc85d95ef45bf8ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_decimal.pyd

Filesize
104KB

MD5
9b801838394e97e30c99dcf5f9fcc8fa

SHA1
33fb049b2f98bcb2f2cb9508be2408a6698243be

SHA256
15668e03f9c55f07184ec9c048a8569f7d7ebd9ea6dbef145f1f3b581f8623f3

SHA512
5f074c82f344ca43a07a59132fab59e3504e314a2f7673bfec906782b947daf8fe45a1b956f72502eae72f01369a3bb1fbb73b10dc605d43b889a6700bd98a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_hashlib.pyd

Filesize
33KB

MD5
7fd141630dfa2500f5bf4c61e2c2d034

SHA1
0f8d1dfae2cbce1ad714c93216f01bf7001aabda

SHA256
689f0ac1d44481688cd4ae90b6f801176a52ff4bb4170c62575ea58f44452e15

SHA512
c6b7b1aefb7280f38d63f4ab84a349ebb696ca7300b7a451e7a994baff7e0a83fb4488c43ed3160b94dec74e0d27417d68913056b3006c8c6da11e39681f512e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_lzma.pyd

Filesize
84KB

MD5
ab6a735ad62592c7c8ea0b06cb57317a

SHA1
e27a0506800b5bbc2b350e39899d260164af2cd1

SHA256
0ebdf15c1c6d59e49716dfb4601f0abe6383449c70db1a349c6ad486742144a8

SHA512
9a285593cd8cc29844688723d8907e55a9f8a3109f9538cc4140912cc973f495de32779a4cd4a48dc62d680fdf81a5797e4e9c33f236a803082dfc3c00d02060

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_multiprocessing.pyd

Filesize
25KB

MD5
241a977372d63b46b6ae4f7227579cc3

SHA1
21c8fa02217ec69c5cc9a1cc9edaa5de6f8d9f91

SHA256
04e56f1c6919f2987f205e9e3afa16d945eeaffa415c746104ccb7763c067f9c

SHA512
7aeaa94a5cd46d604370e430c72724b683e149af7e032c85708e33bfb94fb6a9ccc52c70bc701dfb94b4ae55d4e8acd8e394efb6cd81466fd9fa1a6addaa4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_overlapped.pyd

Filesize
30KB

MD5
ef52dc3e7d12795745e23487026a5b5e

SHA1
6c9f488a9eaabdc6db11ed2c32231d518a8b8f42

SHA256
b1b56328df4b19cf04586303f693979536253078fc7017b4ac4ae6d730296b1f

SHA512
8b3c311bf4a54eaa21fa1db058037b274bd3b9e838e844537269f8e0102ad47ca7181e73bbb4f5269100cfe82499bb0787bc04943b02e36ea0ab26bfa8e65326

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_queue.pyd

Filesize
24KB

MD5
71955beaf83aca364ed64285021781ca

SHA1
cac93d08f9085079fb32e6fc6d8e4fc8cd9115e6

SHA256
3df280391d7275e73aef70af228bb21c03434147ae9fe31e8c620ea151e08b30

SHA512
9b055a0273ace0f9b673e015a20c8867689090608fffaf85c54636f061cf595de1e6c9bfc2d8ea75fa4dd247b4af0493022f24d6a931b53e7f60009a85b45601

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_socket.pyd

Filesize
41KB

MD5
53dc1aa457a1e3b4f6c8baed19a6ca0a

SHA1
290a572e981cc5ce896dc52a53f112d9eaaefc39

SHA256
26200892f616f859e82c167701ab866b8291eabbe808dd18c434cc80ebeedf19

SHA512
460de92115288e0e95fd03837df775e5f34425784c18ab7e9ad0885511166371647a6f06d95ffa6c3437de69895d46cd4cddcda2841ccdb5ef268b1a857837e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_sqlite3.pyd

Filesize
54KB

MD5
1c5e0718dce15682d32185f1e1f8df7d

SHA1
f59662db717663ed1589328c5749bb8b44a0d053

SHA256
56f74ec6490b916c513b618635edaa22cb2374a92e5f79549c1e2b7c5c37f31d

SHA512
702f8348d2fe08ec10e0120129e64c12368c971ea52852cd0c7d26fd159f5b34bc808b9b318168aaa81366ed4944909e305d4e9727f0374d921eddb54ea22cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_ssl.pyd

Filesize
60KB

MD5
df5a6f6c547300a7c87005eb0fafcfa0

SHA1
c792342e964a1c8a776e5203f3eee7908e6cad09

SHA256
dea09b9750c26813130ca32db0b4455796e12a3d61bb52066d5a53302bcce0ce

SHA512
018a79871faa2cf6a1644e96f10750ddccccd56436720faf760808b1997940f9bcd2866a4533b903058ab608629ff8ed46fadb788e4a6714b19775d557dd69b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\_uuid.pyd

Filesize
21KB

MD5
cf378e1866edaa02db65a838f0e0ad8e

SHA1
cc66b98b3289a126fa4cf960d89cbbecff0f5aa8

SHA256
caabfac7123e70906fafe3a34d11c0c87c62695b2716a5f95b032bb54982744e

SHA512
cdb6fb5861fee4eeee49dd79ba164ef8538235b0b41e505dd59f1b5a79256390a4bb920ade9ff58abdc41c738ec6f316d387df4f588b673d8f324e5c1c32a9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\base_library.zip

Filesize
1.4MB

MD5
481da210e644d6b317cafb5ddf09e1a5

SHA1
00fe8e1656e065d5cf897986c12ffb683f3a2422

SHA256
3242ea7a6c4c712f10108a619bf5213878146547838f7e2c1e80d2778eb0aaa0

SHA512
74d177794f0d7e67f64a4f0c9da4c3fd25a4d90eb909e942e42e5651cc1930b8a99eef6d40107aa8756e75ffbcc93284b916862e24262df897aaac97c5072210

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\libcrypto-1_1.dll

Filesize
1.1MB

MD5
571796599d616a0d12aa34be09242c22

SHA1
0e0004ab828966f0c8a67b2f10311bb89b6b74ac

SHA256
6242d2e13aef871c4b8cfd75fc0f8530e8dccfeaba8f1b66280e9345f52b833b

SHA512
7362a6c887600fafc1a45413823f006589bb95a76ac052b6c7022356a7a9a6e8cd3e76f59cecf152e189323791d9626a6fdb7a98bf3a5250d517b746c3e84e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\libffi-8.dll

Filesize
24KB

MD5
24ea21ebcc3bef497d2bd208e7986f88

SHA1
d936f79431517b9687ee54d837e9e4be7afc082d

SHA256
18c097ef19f3e502a025c1d63cfec73a4fa30c5482286f4000d40d4784a0070a

SHA512
1bdbeddd812ecc2cdfbbf3498b0a8ef551cc18ce73fc30eb40b415fab0cdd20b80057a25a33ca2f9247b08978838df3587a3caf6e1a8e108c5a9a4f67dd75a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\libssl-1_1.dll

Filesize
203KB

MD5
aabafc5d0e409123ae5e4523d9b3dee2

SHA1
4d0a1834ed4e4ceecb04206e203d916eb22e981b

SHA256
84e4c37fb28b6cf79e2386163fe6bb094a50c1e8825a4bcdb4cb216f4236d831

SHA512
163f29ad05e830367af3f2107e460a587f4710b8d9d909a01e04cd8cfee115d8f453515e089a727a6466ce0e2248a56f14815588f7df6d42fe1580e1b25369cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\luna.aes

Filesize
294KB

MD5
073300e100dc8efd99efd3c781515e0d

SHA1
0d67d3f1261fa50929841f354093743c7d77678e

SHA256
b5405574857254bfaaf444da5d11e8fcc087261cd7f3bb6d77b5237cc769a9d8

SHA512
09f03eaa2f25fe7aaad32c09d3bae4f182cbcf4aa35e5202e31a7922328df72e8a3e3605ed286912a7267ffcb10ba9ced66ed474c3b7cd8b4ae99263a4354113

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\pyexpat.pyd

Filesize
86KB

MD5
c498ed10d7245560412f9df527508b5c

SHA1
b84b57a54a1a9c5631f4d0b8ac31694786cc822b

SHA256
297ec9e654500400ba5731101b65d29c14d0305ae9f6c05b9763f57ab150b07d

SHA512
ab8bcf6e4a395944316e19aa7aa598e8bfeaa038f4ae086fcede6d01747b670896d640dbf4992630fcbd737d2be3ab627b7be8ad36437629671387f4aaf85957

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\python311.dll

Filesize
1.6MB

MD5
4fcf14c7837f8b127156b8a558db0bb2

SHA1
8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f

SHA256
a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc

SHA512
7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\select.pyd

Filesize
24KB

MD5
0dc8f694b3e6a3682b3ff098bd2468f6

SHA1
737252620116c6ac5c527f99d3914e608a0e5a74

SHA256
818120c08358b6b4d1234b7456c7b5c777af8473e26314a6a6c0f37237d53208

SHA512
d0e704d52b0c5e24c07447a60d71ccec490ec15ecb6b4532b2e93ac07036bda7f27051f80dac1ef3705b0186f35f9d6dfc05415412e483b68fd79f1098411123

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\sqlite3.dll

Filesize
608KB

MD5
605b722497acc50ffb33ebdb6afaf1f0

SHA1
e24c55472c827d4b519e5b6f0a3cfc49e10d1fa9

SHA256
a61016520a3f228285e32e40d878fe449450136c55aa9d4d7b54006a8dc7f339

SHA512
9611afc66cd1236cea1fce94e8ecf8e4d2168db3b51d8d9a799b574e8523ca0aea48da6b6c15fc863dd737b9c394ac6e56d2f3fa45e29792b630da389cb21dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21922\unicodedata.pyd

Filesize
293KB

MD5
2b1809546e4bc9d67ea69d24f75edce0

SHA1
9d076445dfa2f58964a6a1fd1844f6fe82645952

SHA256
89cbb2814a75a5bd53acbfb1fe090ca8395c4a7f559acd4fe0187758c172623a

SHA512
5ae015add4697e8290eb881fa770bca2fa22ba8376b86b26f7880d4f92ad362e741042926a4c47cc3413c83f445e372ffda915bcf8567673d807bd2dac28fbbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_1099072465\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_1099072465\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_1099072465\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_1099072465\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\Downloads\Nightlight-main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_762885378\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_762885378\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
memory/4328-2822-0x00007FFF45330000-0x00007FFF45348000-memory.dmp

Filesize
96KB

Download
memory/4328-2806-0x00007FFF57A30000-0x00007FFF57A49000-memory.dmp

Filesize
100KB

Download
memory/4328-2812-0x00007FFF4DAF0000-0x00007FFF4DB09000-memory.dmp

Filesize
100KB

Download
memory/4328-2810-0x00007FFF44540000-0x00007FFF448B5000-memory.dmp

Filesize
3.5MB

Download
memory/4328-2813-0x00007FFF453A0000-0x00007FFF45427000-memory.dmp

Filesize
540KB

Download
memory/4328-2814-0x00007FFF5C390000-0x00007FFF5C39D000-memory.dmp

Filesize
52KB

Download
memory/4328-2815-0x00007FFF45380000-0x00007FFF45394000-memory.dmp

Filesize
80KB

Download
memory/4328-2816-0x00007FFF45800000-0x00007FFF4582E000-memory.dmp

Filesize
184KB

Download
memory/4328-2818-0x00007FFF45350000-0x00007FFF45376000-memory.dmp

Filesize
152KB

Download
memory/4328-2817-0x00007FFF596B0000-0x00007FFF596BB000-memory.dmp

Filesize
44KB

Download
memory/4328-2819-0x00007FFF457D0000-0x00007FFF457FB000-memory.dmp

Filesize
172KB

Download
memory/4328-2820-0x00007FFF59270000-0x00007FFF5927A000-memory.dmp

Filesize
40KB

Download
memory/4328-2809-0x00007FFF45430000-0x00007FFF454E8000-memory.dmp

Filesize
736KB

Download
memory/4328-2821-0x00007FFF45520000-0x00007FFF4563C000-memory.dmp

Filesize
1.1MB

Download
memory/4328-2823-0x00007FFF454F0000-0x00007FFF4551E000-memory.dmp

Filesize
184KB

Download
memory/4328-2824-0x00007FFF452B0000-0x00007FFF452D3000-memory.dmp

Filesize
140KB

Download
memory/4328-2826-0x00007FFF450D0000-0x00007FFF45243000-memory.dmp

Filesize
1.4MB

Download
memory/4328-2825-0x00007FFF45430000-0x00007FFF454E8000-memory.dmp

Filesize
736KB

Download
memory/4328-2827-0x00007FFF44540000-0x00007FFF448B5000-memory.dmp

Filesize
3.5MB

Download
memory/4328-2838-0x00007FFF452A0000-0x00007FFF452AC000-memory.dmp

Filesize
48KB

Download
memory/4328-2837-0x00007FFF453A0000-0x00007FFF45427000-memory.dmp

Filesize
540KB

Download
memory/4328-2836-0x00007FFF58AB0000-0x00007FFF58ABB000-memory.dmp

Filesize
44KB

Download
memory/4328-2835-0x00007FFF4CC80000-0x00007FFF4CC8C000-memory.dmp

Filesize
48KB

Download
memory/4328-2834-0x00007FFF51FB0000-0x00007FFF51FBB000-memory.dmp

Filesize
44KB

Download
memory/4328-2833-0x00007FFF58610000-0x00007FFF5861C000-memory.dmp

Filesize
48KB

Download
memory/4328-2832-0x00007FFF586A0000-0x00007FFF586AB000-memory.dmp

Filesize
44KB

Download
memory/4328-2831-0x00007FFF588B0000-0x00007FFF588BC000-memory.dmp

Filesize
48KB

Download
memory/4328-2830-0x00007FFF58940000-0x00007FFF5894B000-memory.dmp

Filesize
44KB

Download
memory/4328-2829-0x00007FFF45090000-0x00007FFF450C7000-memory.dmp

Filesize
220KB

Download
memory/4328-2828-0x000001E49B300000-0x000001E49B675000-memory.dmp

Filesize
3.5MB

Download
memory/4328-2842-0x00007FFF45060000-0x00007FFF4506B000-memory.dmp

Filesize
44KB

Download
memory/4328-2846-0x00007FFF450D0000-0x00007FFF45243000-memory.dmp

Filesize
1.4MB

Download
memory/4328-2849-0x00007FFF44520000-0x00007FFF4452C000-memory.dmp

Filesize
48KB

Download
memory/4328-2848-0x00007FFF452B0000-0x00007FFF452D3000-memory.dmp

Filesize
140KB

Download
memory/4328-2847-0x00007FFF44510000-0x00007FFF4451D000-memory.dmp

Filesize
52KB

Download
memory/4328-2845-0x00007FFF44530000-0x00007FFF4453C000-memory.dmp

Filesize
48KB

Download
memory/4328-2844-0x00007FFF45050000-0x00007FFF4505B000-memory.dmp

Filesize
44KB

Download
memory/4328-2843-0x00007FFF59270000-0x00007FFF5927A000-memory.dmp

Filesize
40KB

Download
memory/4328-2841-0x00007FFF45070000-0x00007FFF4507C000-memory.dmp

Filesize
48KB

Download
memory/4328-2850-0x00007FFF444F0000-0x00007FFF44502000-memory.dmp

Filesize
72KB

Download
memory/4328-2840-0x00007FFF45080000-0x00007FFF4508E000-memory.dmp

Filesize
56KB

Download
memory/4328-2839-0x00007FFF45380000-0x00007FFF45394000-memory.dmp

Filesize
80KB

Download
memory/4328-2852-0x00007FFF444E0000-0x00007FFF444EC000-memory.dmp

Filesize
48KB

Download
memory/4328-2853-0x00007FFF444B0000-0x00007FFF444D9000-memory.dmp

Filesize
164KB

Download
memory/4328-2851-0x00007FFF45090000-0x00007FFF450C7000-memory.dmp

Filesize
220KB

Download
memory/4328-2854-0x00007FFF444A0000-0x00007FFF444AB000-memory.dmp

Filesize
44KB

Download
memory/4328-2855-0x00007FFF44480000-0x00007FFF4449C000-memory.dmp

Filesize
112KB

Download
memory/4328-2856-0x00007FFF44050000-0x00007FFF44472000-memory.dmp

Filesize
4.1MB

Download
memory/4328-2857-0x00007FFF42C00000-0x00007FFF43FA7000-memory.dmp

Filesize
19.7MB

Download
memory/4328-2859-0x00007FFF42BD0000-0x00007FFF42BF2000-memory.dmp

Filesize
136KB

Download
memory/4328-2858-0x00007FFF44530000-0x00007FFF4453C000-memory.dmp

Filesize
48KB

Download
memory/4328-2860-0x00007FFF42980000-0x00007FFF42BC8000-memory.dmp

Filesize
2.3MB

Download
memory/4328-2876-0x00007FFF444F0000-0x00007FFF44502000-memory.dmp

Filesize
72KB

Download
memory/4328-2877-0x00007FFF444B0000-0x00007FFF444D9000-memory.dmp

Filesize
164KB

Download
memory/4328-2808-0x00007FFF4DB10000-0x00007FFF4DB3D000-memory.dmp

Filesize
180KB

Download
memory/4328-2897-0x00007FFF44050000-0x00007FFF44472000-memory.dmp

Filesize
4.1MB

Download
memory/4328-2807-0x00007FFF454F0000-0x00007FFF4551E000-memory.dmp

Filesize
184KB

Download
memory/4328-2811-0x000001E49B300000-0x000001E49B675000-memory.dmp

Filesize
3.5MB

Download
memory/4328-2948-0x00007FFF454F0000-0x00007FFF4551E000-memory.dmp

Filesize
184KB

Download
memory/4328-2943-0x00007FFF5C390000-0x00007FFF5C39D000-memory.dmp

Filesize
52KB

Download
memory/4328-2958-0x00007FFF450D0000-0x00007FFF45243000-memory.dmp

Filesize
1.4MB

Download
memory/4328-2941-0x00007FFF4DAF0000-0x00007FFF4DB09000-memory.dmp

Filesize
100KB

Download
memory/4328-2936-0x00007FFF58840000-0x00007FFF58864000-memory.dmp

Filesize
144KB

Download
memory/4328-2935-0x00007FFF448C0000-0x00007FFF44EA8000-memory.dmp

Filesize
5.9MB

Download
memory/4328-2959-0x00007FFF45090000-0x00007FFF450C7000-memory.dmp

Filesize
220KB

Download
memory/4328-2964-0x00007FFF42C00000-0x00007FFF43FA7000-memory.dmp

Filesize
19.7MB

Download
memory/4328-2989-0x00007FFF42980000-0x00007FFF42BC8000-memory.dmp

Filesize
2.3MB

Download
memory/4328-2805-0x00007FFF45520000-0x00007FFF4563C000-memory.dmp

Filesize
1.1MB

Download
memory/4328-2802-0x00007FFF45640000-0x00007FFF456FC000-memory.dmp

Filesize
752KB

Download
memory/4328-2803-0x00007FFF457D0000-0x00007FFF457FB000-memory.dmp

Filesize
172KB

Download
memory/4328-2804-0x00007FFF58840000-0x00007FFF58864000-memory.dmp

Filesize
144KB

Download
memory/4328-2801-0x00007FFF448C0000-0x00007FFF44EA8000-memory.dmp

Filesize
5.9MB

Download
memory/4328-3280-0x00007FFF62C80000-0x00007FFF62C8F000-memory.dmp

Filesize
60KB

Download
memory/4328-3323-0x00007FFF45520000-0x00007FFF4563C000-memory.dmp

Filesize
1.1MB

Download
memory/4328-3347-0x00007FFF45350000-0x00007FFF45376000-memory.dmp

Filesize
152KB

Download
memory/4328-3346-0x00007FFF45800000-0x00007FFF4582E000-memory.dmp

Filesize
184KB

Download
memory/4328-3351-0x00007FFF44480000-0x00007FFF4449C000-memory.dmp

Filesize
112KB

Download
memory/4328-3350-0x00007FFF444A0000-0x00007FFF444AB000-memory.dmp

Filesize
44KB

Download
memory/4328-3349-0x00007FFF450D0000-0x00007FFF45243000-memory.dmp

Filesize
1.4MB

Download
memory/4328-3348-0x00007FFF444B0000-0x00007FFF444D9000-memory.dmp

Filesize
164KB

Download
memory/4328-3345-0x00007FFF5C390000-0x00007FFF5C39D000-memory.dmp

Filesize
52KB

Download
memory/4328-3344-0x00007FFF5C540000-0x00007FFF5C54D000-memory.dmp

Filesize
52KB

Download
memory/4328-3343-0x00007FFF4DAF0000-0x00007FFF4DB09000-memory.dmp

Filesize
100KB

Download
memory/4328-3342-0x00007FFF45830000-0x00007FFF45865000-memory.dmp

Filesize
212KB

Download
memory/4328-3341-0x00007FFF4DB10000-0x00007FFF4DB3D000-memory.dmp

Filesize
180KB

Download
memory/4328-3340-0x00007FFF57A30000-0x00007FFF57A49000-memory.dmp

Filesize
100KB

Download
memory/4328-3339-0x00007FFF5C8A0000-0x00007FFF5C8AF000-memory.dmp

Filesize
60KB

Download
memory/4328-3338-0x00007FFF58840000-0x00007FFF58864000-memory.dmp

Filesize
144KB

Download
memory/4328-3337-0x00007FFF457D0000-0x00007FFF457FB000-memory.dmp

Filesize
172KB

Download
memory/4328-3336-0x00007FFF62C80000-0x00007FFF62C8F000-memory.dmp

Filesize
60KB

Download
memory/4328-3335-0x00007FFF45090000-0x00007FFF450C7000-memory.dmp

Filesize
220KB

Download
memory/4328-3333-0x00007FFF452B0000-0x00007FFF452D3000-memory.dmp

Filesize
140KB

Download
memory/4328-3332-0x00007FFF45330000-0x00007FFF45348000-memory.dmp

Filesize
96KB

Download
memory/4328-3331-0x00007FFF59270000-0x00007FFF5927A000-memory.dmp

Filesize
40KB

Download
memory/4328-3329-0x00007FFF596B0000-0x00007FFF596BB000-memory.dmp

Filesize
44KB

Download
memory/4328-3328-0x00007FFF45380000-0x00007FFF45394000-memory.dmp

Filesize
80KB

Download
memory/4328-3327-0x00007FFF453A0000-0x00007FFF45427000-memory.dmp

Filesize
540KB

Download
memory/4328-3326-0x00007FFF44540000-0x00007FFF448B5000-memory.dmp

Filesize
3.5MB

Download
memory/4328-3325-0x00007FFF45430000-0x00007FFF454E8000-memory.dmp

Filesize
736KB

Download
memory/4328-3352-0x00007FFF42C00000-0x00007FFF43FA7000-memory.dmp

Filesize
19.7MB

Download
memory/4328-3324-0x00007FFF454F0000-0x00007FFF4551E000-memory.dmp

Filesize
184KB

Download
memory/4328-3321-0x00007FFF45640000-0x00007FFF456FC000-memory.dmp

Filesize
752KB

Download
memory/4328-3311-0x00007FFF448C0000-0x00007FFF44EA8000-memory.dmp

Filesize
5.9MB

Download
memory/4328-3355-0x00007FFF42980000-0x00007FFF42BC8000-memory.dmp

Filesize
2.3MB

Download
memory/4328-3354-0x00007FFF42BD0000-0x00007FFF42BF2000-memory.dmp

Filesize
136KB

Download
memory/4328-3353-0x00007FFF44050000-0x00007FFF44472000-memory.dmp

Filesize
4.1MB

Download
memory/4328-2800-0x00007FFF45800000-0x00007FFF4582E000-memory.dmp

Filesize
184KB

Download
memory/4328-2799-0x00007FFF5C390000-0x00007FFF5C39D000-memory.dmp

Filesize
52KB

Download
memory/4328-2798-0x00007FFF5C540000-0x00007FFF5C54D000-memory.dmp

Filesize
52KB

Download
memory/4328-2795-0x00007FFF45830000-0x00007FFF45865000-memory.dmp

Filesize
212KB

Download
memory/4328-2797-0x00007FFF4DAF0000-0x00007FFF4DB09000-memory.dmp

Filesize
100KB

Download
memory/4328-2774-0x00007FFF4DB10000-0x00007FFF4DB3D000-memory.dmp

Filesize
180KB

Download
memory/4328-2771-0x00007FFF57A30000-0x00007FFF57A49000-memory.dmp

Filesize
100KB

Download
memory/4328-2768-0x00007FFF5C8A0000-0x00007FFF5C8AF000-memory.dmp

Filesize
60KB

Download
memory/4328-2766-0x00007FFF58840000-0x00007FFF58864000-memory.dmp

Filesize
144KB

Download
memory/4328-2758-0x00007FFF448C0000-0x00007FFF44EA8000-memory.dmp

Filesize
5.9MB

Download