hxxps://www[.]mediafire[.]com/file/wa5i4f214bgaoge/LunaExecutor[.]zip/file

Analysis

user interaction
yes
max time kernel
125s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/wa5i4f214bgaoge/LunaExecutor.zip/file
Sample260801-mlxaeahl4w

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
212	LunaExecutor.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1320	msedge.exe
3224	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300540456306326"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D844F663-1356-4B79-878D-1A68E698BD39}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
212	LunaExecutor.exe
212	LunaExecutor.exe
212	LunaExecutor.exe
212	LunaExecutor.exe
212	LunaExecutor.exe
212	LunaExecutor.exe
3932	chrome.exe
3932	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 1928	3772	msedge.exe	84
PID 3772 wrote to memory of 1320	3772	msedge.exe	85
PID 3772 wrote to memory of 1984	3772	msedge.exe	86
PID 3772 wrote to memory of 1984	3772	msedge.exe	86
PID 3772 wrote to memory of 1984	3772	msedge.exe	86
PID 3772 wrote to memory of 3512	3772	msedge.exe	87
PID 3772 wrote to memory of 3512	3772	msedge.exe	87
PID 3772 wrote to memory of 4336	3772	msedge.exe	88
PID 3772 wrote to memory of 2964	3772	msedge.exe	89
PID 3772 wrote to memory of 4336	3772	msedge.exe	88
PID 3772 wrote to memory of 4336	3772	msedge.exe	88
PID 3772 wrote to memory of 2964	3772	msedge.exe	89
PID 3772 wrote to memory of 2964	3772	msedge.exe	89
PID 3772 wrote to memory of 1076	3772	msedge.exe	91
PID 3772 wrote to memory of 1076	3772	msedge.exe	91
PID 3772 wrote to memory of 1076	3772	msedge.exe	91
PID 3772 wrote to memory of 3852	3772	msedge.exe	92
PID 3772 wrote to memory of 3852	3772	msedge.exe	92
PID 3772 wrote to memory of 3852	3772	msedge.exe	92
PID 3772 wrote to memory of 2968	3772	msedge.exe	95
PID 3772 wrote to memory of 2968	3772	msedge.exe	95
PID 3772 wrote to memory of 2968	3772	msedge.exe	95
PID 3772 wrote to memory of 884	3772	msedge.exe	97
PID 3772 wrote to memory of 884	3772	msedge.exe	97
PID 3772 wrote to memory of 884	3772	msedge.exe	97
PID 3772 wrote to memory of 1568	3772	msedge.exe	98
PID 3772 wrote to memory of 1568	3772	msedge.exe	98
PID 3772 wrote to memory of 4820	3772	msedge.exe	99
PID 3772 wrote to memory of 4820	3772	msedge.exe	99
PID 3772 wrote to memory of 1192	3772	msedge.exe	101
PID 3772 wrote to memory of 1192	3772	msedge.exe	101
PID 3772 wrote to memory of 1192	3772	msedge.exe	101
PID 3772 wrote to memory of 1272	3772	msedge.exe	103
PID 3772 wrote to memory of 4336	3772	msedge.exe	104
PID 3772 wrote to memory of 4336	3772	msedge.exe	104
PID 3772 wrote to memory of 4336	3772	msedge.exe	104
PID 3772 wrote to memory of 3716	3772	msedge.exe	105
PID 3772 wrote to memory of 3716	3772	msedge.exe	105
PID 3772 wrote to memory of 3716	3772	msedge.exe	105
PID 3772 wrote to memory of 4348	3772	msedge.exe	106
PID 3772 wrote to memory of 4348	3772	msedge.exe	106
PID 3772 wrote to memory of 4348	3772	msedge.exe	106
PID 3772 wrote to memory of 3736	3772	msedge.exe	107
PID 3772 wrote to memory of 3736	3772	msedge.exe	107
PID 3772 wrote to memory of 3736	3772	msedge.exe	107
PID 3772 wrote to memory of 3896	3772	msedge.exe	108
PID 3772 wrote to memory of 3896	3772	msedge.exe	108
PID 3772 wrote to memory of 3896	3772	msedge.exe	108
PID 3772 wrote to memory of 1216	3772	msedge.exe	109
PID 3772 wrote to memory of 1216	3772	msedge.exe	109
PID 3772 wrote to memory of 1216	3772	msedge.exe	109
PID 3772 wrote to memory of 4704	3772	msedge.exe	110
PID 3772 wrote to memory of 4704	3772	msedge.exe	110
PID 3772 wrote to memory of 4704	3772	msedge.exe	110
PID 3772 wrote to memory of 2488	3772	msedge.exe	112
PID 3772 wrote to memory of 3256	3772	msedge.exe	111
PID 3772 wrote to memory of 2488	3772	msedge.exe	112
PID 3772 wrote to memory of 2488	3772	msedge.exe	112
PID 3772 wrote to memory of 3256	3772	msedge.exe	111
PID 3772 wrote to memory of 4984	3772	msedge.exe	113
PID 3772 wrote to memory of 4984	3772	msedge.exe	113
PID 3772 wrote to memory of 4984	3772	msedge.exe	113
PID 3772 wrote to memory of 5220	3772	msedge.exe	114
PID 3772 wrote to memory of 5672	3772	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/wa5i4f214bgaoge/LunaExecutor.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa9ab3c188,0x7ffa9ab3c194,0x7ffa9ab3c1a0
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,10988639002735673253,5899780826491877343,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,5663888340017626453,5248746606411251889,262144 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,18171073117613369762,14122302343288019455,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,4663452327106528894,8407616694653964359,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,7186676160586262630,2254593306022450869,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,323691801991098751,16733779224615764271,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,9723524802967156685,6107363395689958451,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3548,i,2529930622836428928,14259574898959405682,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5244,i,1834543496697106822,17889160883407640792,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,972625364782863040,17802346770754059455,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,1051960120598596724,13049773478026585332,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6104,i,9737756994717884668,13394989616304937207,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,1392229762855917617,3410110205128118915,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,1392229762855917617,3410110205128118915,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5304,i,12878584003074896725,15931711052264445849,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6808,i,15878766824406897722,3574340531942951432,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6892,i,7414082751020937687,12342195747225571028,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7024,i,5451898612182324699,3644529964800279908,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7112,i,8823353146704568000,9947923137685352435,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7280,i,11832078856449586796,5514439937981748320,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7492,i,1992543568227610712,14056594338268757696,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7768,i,11083719153175728355,16427226724364962894,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7796,i,16061552125690280494,3602476899982334607,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8172,i,18151143332422688100,5616590832013975703,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8748,i,11754935189956498513,9045347339311084491,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7660,i,6995557144359837749,16759396596932061028,2097152 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,15461221821894290183,14027049639822882054,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,5656749778763555454,15828694539710681336,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,7130811790860729329,2034671584798440939,524288 --field-trial-handle=2232,i,11800633760971925799,1390085909244107350,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:8
  2⤵
  PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6076

C:\Users\Admin\Desktop\LunaExecutor\LunaExecutor.exe
"C:\Users\Admin\Desktop\LunaExecutor\LunaExecutor.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9a4cc728,0x7ffa9a4cc734,0x7ffa9a4cc740
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,14846352822683481677,5471704339055785783,262144 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,601781432804461516,7917256429188217881,524288 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,568264082151847059,17231573446057873684,524288 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,16823889675921202688,2162822106001215395,2097152 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,4444804060156435632,5734314399805465319,2097152 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,6615127363493228838,11445501718258468695,2097152 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,2583944280924307592,9916083771716341368,2097152 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,1339342747276653543,17529312199505458092,524288 --field-trial-handle=1820,i,2347942637662093777,11732057942063202619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f3b5abe207784fd7b75b834ed00ea2f2cd58870ef3aaf2e69d7fd4133e693500
MD5 294a6acef5340522677dd4919caf7460
SHA1 cb45a7b67b5e9f081035bd441494aa33dff47ec0
SHA512 0f263ec2aa5f1dd9a28d09b43e366c70e9c3210a86fc5600a7fa7c9151fe841f9ce8d6cffdbce23a456248a7f6b551bd6d42d2259425d65b557828fe61b25680
TLSH
T198E0ABB5C922AC3B09FC1358A4614745E645131B2A40884F373E420C8FB433A4A86C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 01cd4f54b9862344b53ef8c2b529da2bf68d05b26156f518b7651f2e9afe7f59
MD5 3289a94717f7ad945e4d99ea700b6723
SHA1 33e22a1a0df9fcc55b127d5a3a4e40bc4a12ac96
SHA512 149c90274ac1eefe60c1733d331950b9101cac4da9438859915c782767f3e4e6bb1094197d5102103ebf04533848119f72b6b05eb6d94b88f68600e8fda71c95
TLSH
T1F3517BF3D7E89A6D851156F4DB216E1FCD2D0A14531D3C6288D8AE6B53E2C72D20174E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 515B
SHA256 57a5d59077d6f18f2f9e7f2766da78fb81519935e0054450b3a86aaf1f8771d4
MD5 7e72530a7609dccd95632eafb3333007
SHA1 d1b69036fdb30ac28c4a099de60fabe3d670ff72
SHA512 91e7e65ffd8ff505fe6bb9bb1d138d0953c0578d0b9e7e9885af579dadcc7edad0962825c625f3d9566f65e1989d56a4b19c51b1b10454877e89ba8c79bba99d
TLSH
T1F0F059A7E62DB06750B905EB0D00BC0955B9B830024258E4DF9A826CE0D80E30B6306B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cf5d68c5c8cf24b78717253c5fb8a1948c5cb065e13aed2ef5014b7e75b6a1bc
MD5 569ccd9ec2013ff286443862f2ed47e2
SHA1 67e8ce1764c91a8eb1a1d00ce1624ae3afe1b294
SHA512 f96e7e992943b7c65497c396a90a307f5e270602f3d63191a8d72fe9f5b4d1aad0241bd3165e9b0708c0a8f79e7575847dfcc3c460fcd5eb6d7251b672f7cb3b
SSDEEP 192:URMxxUwSehv7MF+hAPRp2S9HHsb+WNn0z0GU2uBYkwsIhPyIsnAUgtaJ:URMxvxgo8X91w00f2uBYMM8
TLSH
T1E942B66ABE15787B6CDAC22AFD227F03D7F5103225851E84EAFC992C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8b45434e978859b48cc9ddcbef647a6130e5fb14e7a834159dd3f71f24016e6b
MD5 fe79053b3d89bc4c2d997b7e1015504f
SHA1 a5df94e91fcd23be01aee764a79616cdec33f5b4
SHA512 b6cb8f1e1b845e1ad865cdb62f9bba6c11250b3d4975afcf076e82c1326a5f68f18149e79b672dd73b75ec8f7b9f7b6655888509b99caadab7cbb5803355002b
SSDEEP 192:URMxxUwSe0v7MF+pAPRp2S9HHsb+WNn0z07U2uBYkwsI7VyIsnAUgtaJ:URMxvwgoUX91w00o2uBYMQ8
TLSH
T1C942C86EBE15787B6CDAC22AFD227B03D7F5103225851E84EAFC992C14E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3f533f12434eca2ca39e6578e75a81d00b352e747e30c0f47abf016b845a6c43
MD5 31eb9e43f6caf2a5414a58c02b1cb65e
SHA1 16c63fa116ebad4a97e0a32bea92faf2644b948b
SHA512 9e64d0cc14daabe34203b8c9e6d41fafc07fc809d221734beabaa20b54f4506c0776ed3a3a127f380109596c317659377418ebeba604b7d6629406814fd6ce80
TLSH
T10EB0120580419100C00601B4111318D8E248DF169A0D1F0393E0B923882606185140A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f38e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f38e.TMP
Size 96B
SHA256 040d4c52a1c47ea4d9961cf13e15994b2b025840527f6afd1bbb67525c031fd4
MD5 20063cca4141502836c330f048484504
SHA1 9fecd6eff663f125d8706944051429015f456dc4
SHA512 80233fbe38a33d4c45746f1205eb6f30b3886a88f5bc3bd8513beffe8f98a9877f6dd3698d8f013a7fb57c92ac9ffa850e92bfe3d48dfa6808e025745a0abe81
TLSH
T1C7B02280C002B303C00203F03CA2ACC83020EF22C2032203E2E00AFACE233200E2A020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 08e62fa4d1ff04d7a9d8b4ce67bd8815ae3cf665000d6379168a493a80b50301
MD5 5dcff58a96f9ca594b2adfd199453bb1
SHA1 58dd270147480c80a81350b8c2a04a84fdcef9b6
SHA512 78106a66b4ed989a48eca253fc14b992b44ec66a978e275612918c3a8c695c6b03ec0c837e8a4772f0f0d86b7a5eef29979caa6f6d6d44163576f99ea29c53ba
SSDEEP 3072:/1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/cm7Rkm1tYpBeh2BAoM
TLSH
T1D7C312275E75E9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e73bf0b8651357444276080ea06538978d50e3cbd98e79e379c6fafe91736066
MD5 745991b1f186085403fd2566d9f28714
SHA1 5e41e105ad1d0cf2bb46070411c3205f2d2cba28
SHA512 b95ecff312b6e29e930ca172f100d38680b6845480a3bdabe46028cfe5b6447445ed97c047ea95b2eb11f931c199bf669e00d7fe158e7b30bec9b2e64db83ce9
SSDEEP 6144:GhgEZ0mc2/dsSMb3aP6pqUdFm7Rkm1tYpBeh2BAo+:Ghpt9/SSK3pqL9oBGcAo+
TLSH
T1943422271D695F76A4D89708728B3F1F1E710AA38D55C07598DABE04B3FABCD0A06E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 844f28133a7aa17f03dc2a6ba75bdfcc51c4c1c75de079a1f69c9186ef376da7
MD5 d5e8f3693563e3b5dd347c55a3c6a0b9
SHA1 79d46fda800b247e72bf992230f60a49a7511116
SHA512 4f05d9a34a854d89fcd41fde246c8f9fb663c784f0185594effa485b11c0d34208bab8970df1cedf8d463398022d8daa8bc8d6237a973d4796391600cbf880a2
SSDEEP 6144:GfgEZ0mc2/dsSMb3aP6pqUdFm7Rkm1tYpBeh2BAo+:Gfpt9/SSK3pqL9oBGcAo+
TLSH
T1A03422271D695F76A4D89708728B3F1F1E710AA38D55C07598DABE04B3FABCD0A06E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b50b98bcaa03b9b90e2d0c335d8f75c46e3a86545a9eb814c9bd297b2766a244
MD5 6cff3fb88b933ff101e0c085842946c4
SHA1 8fe9302eb764d43cd3c531487c644e64c21f4553
SHA512 67186e6262e7c79370a020e13b2cfdce7b4028045c9fed258022a03e3c3b38aa501cafc93e081e8b74459f964f19df5ace9a7a13721a64757648b2104293a44a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7i:fwUQC5VwBIiElEd2K57P7i
TLSH
T174B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
MD5 59dfe5a6038e1ae4c00480b3fa70dfbf
SHA1 d8b171ed62e85a9877f2b32db7bf807cb4576c47
SHA512 0cff21ef0bd37ce3d4f98e7940c908c3201d89cc50406b17dab09361007866bd0951b42f1ffce2eceef6f25882ea83f6afe53c995d82bb88973ce086556c906e
TLSH
T1BBD09730FD10A5A1D22A0071001006001E1404B220A782D1A024181CC9B8040C2EABAA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fb6c090bd7ebacfa01507ec576898fda4989dbabedca2a5621feaa8c0d124353
MD5 d3103e78f09ec22b51cfea50882a585d
SHA1 0b7348a5cdf5c51dab378eff350669e687ccee1f
SHA512 7041b4bfe5c75fc59ab6ed6d93512c1e400bde8d2946511ad5553ce446059462472078366725dad1e2999e814d0614289981c69cbfe9f167c3d7a0a914f71485
SSDEEP 96:dA4VzYae8icFcfezcpnq7uCqy6BmDIkTiv:dAYYhWzyarjQmDIkG
TLSH
T19CC1C531DC82D0F0DFA6953604E78525747E62E8FC8BDEC62DAE9AB8114F7D17B80428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 91ac3b92e7a5a956d29645ee7921b0f21dbe153f14da100e1d37ef2d8bc8b95a
MD5 83f53abbc6ee04e25e91970a42c7c8b2
SHA1 86f745b467ea7f46f7b584e88725df1f0fde0c93
SHA512 1596832f06ce2edab2f0a0690350245101516cc5fd050343303f4f9fd05e43aa0be70cdc2bf92e97c79d9a038dde31bd8bdb63eb0ae5566f8d106f2bbd714712
SSDEEP 384:DOde9pNXKZG7TShe4I1hefeJRDsde8JgtnewyQeanWvRBeRHJp8by4IXm140YqrZ:TOHw+/+Xz8b3UU4/fyKixBSa7
TLSH
T197D27AF382E5D92E89111BF896146E1BCF1C0719432D3C1688D5EE8BE3E2072E16E65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 12b85d66ed9397731cd04fa33a3c121420e3549832c3148ae81dd9cc7dc68dcb
MD5 495b1e4a74606f69bf78df7ca6e962c0
SHA1 f29bf04c4b51f6673e4d6fd7e8f1ba4ed0ca6635
SHA512 a8a25fab4f79efc367769031bc6984f74cb8bd42eb3a920a29919e6854425937fe4cfe6f0253a2cccdd31b9044cf08c09cdd3ad4553e88070730f93502c2d58f
SSDEEP 192:sxZHR2yM/jK1Ml8Mk2/fosCi3wnVMIdp8oHW6+WNmJJ/YvwpEB0IgrJ:sxZHkM2/fosCiAbBHbk/AW9
TLSH
T17C52F812AA34A977CCCBD209FA55BF53D6F51472A2910E44A9FCDA1C00E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f1abce0cc1a3351dde670483635d94022c15d77120c710eed304e3e899c56630
MD5 6aea6c8ea8dc0859e8f2590a51213cde
SHA1 ea6e5048ffb200389501e3374bf4a7e9db283751
SHA512 e8d43bf8bb4c0f6293c0865ed80c0bc7c5dbed158cda9f4beac08c64e4784b9ea259d3732a5cb5df7571c27b265244f21af375048a2adb267f8b8457088ac9d0
SSDEEP 192:sxZHR2yM/jK1Ml8Vd2/fos3WpVCigwdVMIdpVd9oHW6+WNbpLq/JJ/YPHuEIiIgs:sxZHkM2/fos3WvCi3NCHbFub/Wls
TLSH
T12562D612AA34597BCCDBD209FA45BF53D6F9143296910E54AAFCDA1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd1c152cf842a3242de3094b79eb62d68e8684058beb1257bf5332c301449a82
MD5 44f4154ddf26c3c9ae409331466f9f23
SHA1 42e4d52da71d2d134da29633c406e43fd46db2ce
SHA512 6af546c6b975c7ec67c6d6109b8b45485a8c4819dcd0c48dd5c89d874cbab9d6d515fae30312376148286cd86c0bc3159fcca029062c7da04d1d7df3212b80fe
SSDEEP 192:sxZHR2yM/jK1Ml8Mf62/fos7i3wnVMIdpVd9oHW6+WNbGJJ/YvwWEB0Ig5GJ:sxZHk362/fos7iAbCHbo/zWE
TLSH
T161520912AA346977CCCBD20AFA45BF53D6F9147296910E54A9FCDA1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6a6af1636f466f6f2c6e1755fec050ded43267c11680d373e56348c258a55096
MD5 09608360ef12d446227a00973ffbeed3
SHA1 db7216a3c8924c2f1d9de287ff419b37fc163639
SHA512 fdb43bd0ce1c30348667a94450d2b8bfd1b2bbacd6b14f8c4a1a5e34c25a2543758e71edfdfd4d9c91e4f42e2ab644ba738009c098a774d25e97e288f96f2aed
SSDEEP 768:dBseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppWroMRS:dBseJ3xWvhfwnu1jaVcL88ptb
TLSH
T1A9E2FA2B280CCB7E4F844E6DEC2AAF966EE801CB57984D5447FA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23204ede2e625619_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\23204ede2e625619_0
Size 63KB
SHA256 1ce94f67a7df1de077ac59795e5842bac188fbad72d5006f7e77fffd7d942608
MD5 3a018d9db22b209f29ba62f51de280a3
SHA1 86717162d2def68563f8c1c0eca51ac57a3d8c19
SHA512 ba2b3570dc3d65dd67b2d1dfc7823ff54ef218e87d0f5a4955169d28e226fca772b86d3ac69b08aa2a83651faf7de097d90a1c32e116511f0ed431f4b699186f
SSDEEP 768:ao7D6c61j/SAXPeEFfgoAaWhrJTt9/XTghUyqxTBXSD74+EACmiQsNnTBVR8noGS:P61j5RmtRXNyqx9XY4JuqdV6no83iPj
TLSH
T126536BA63371B8B3827BA1B190AF170B713ED167B404C4F8A194EEE54A54B9A0177F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8754267d960fef4d7a9cc1831291d527098e15da794043b5bcf9ffbf5128762a
MD5 91fe17cb143cb64652bde04b75df5c09
SHA1 1d4a396376304b03c545df194751a7867d2adc25
SHA512 ffade63fb4562e08e749bf959b7c80457fafcc1175c2d701020d613eee02cea210b0b78afa76547239b497a0fbde5a4eea86a1da9025df56844ac21648702dd7
TLSH
T1EAA002151E503D02D44016706AD2A5C073B44D614301075140D01486CD795925F05700
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 500e8a44d732b630ada2cf6dfc004d4b4fd0280da9fe2b4ba344e9260ee63c7f
MD5 5b40f9024db9d281cdb47c5441afd5e2
SHA1 7280c9a1072b80e73f014cd987c6a35532d964e8
SHA512 801b5edca13c3f7b16e971ef42823943d75b6219bd49261dab7db2add8e9a705180d9988efb62503762e2f7224cf9a47b4b796ea251a4127e09e404cfd11630a
SSDEEP 48:KYHIhKggkXypQIzKpisnypvKLfhVpk5V0PI0nkKDBrJkX/0aUh3d:KYH+KggmKQIKpieqcAKN2ud
TLSH
T18A91B912353B034238BD2458B6A695379E4137533454B96F7FB844A24E27E221EFC8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 267fe6b8b783e74a28b44a09ace51347af013dcdcd7c64accc27ab09654f3f90
MD5 3c1379cb63503a4bf841d9160c551706
SHA1 1e08a8ad24b42c1b21b2d77474e767aca84136ca
SHA512 52727db28775377ff36a9371789f7113c331bdc87cdb861d48f99eb137dafda1f4e9447fd561b23aa32b530f614ba5def1e483aa056e97daf697e8b951409edc
SSDEEP 192:ug7m+xasuheOwQxMGsN9sQ/6M7yAvjQmiU1Iod4MTA++FdLCgFd3Eg8z1/qJtVxN:5IZcIhsN9sGX77vVvyNdtdU5WtVz
TLSH
T162625B719C789C3799A3B246F44A3B134FF4807B9AC46F94A5FC6B1D059A6AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 385a97263bd2f4d0da9b99c88380f80ff25e6df95b715f1b9d1a9fa6adc58b32
MD5 a5553b261f4c7efc98e9fc847eeadf96
SHA1 bc3cb7d850b1a9bec2dd218e75613c8e9910546e
SHA512 2965c55a93197fe7819df7047dbd7bde6d230ba734f6746bb02ad7cc09cbe57d4c9899c77ef876806c0e7b9a83da7a014bf7ebf9ae47bfa49b3a8b1186508971
SSDEEP 192:lONF6vMtPQmiUysbThTA++FdLR847q4U/u:lONF6UtRfT+dVHU/u
TLSH
T11E02F935AC786C7BAAA7AE45F48A37275FE4217B99D05B50EAE82F1C00D764C1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b11323efae2a21a6803fa9b9402238ed308cd31c5c21904f20b0e2ffb0a6ecea
MD5 06204159afb062eaf1bfcb034511ca9b
SHA1 eb4181760b14de10894efd276e9a83b1cb450cf0
SHA512 367e05ce780431119215a533aac6a67c1d54db9a861da58930529f97da21a20aecf93bfb47fab385423ef51fb5b62053d4b961b4330054c151ff4d0d81de0689
SSDEEP 192:ug7m+xasuheOwQxMusN9VQ/6M7yAvkQmiU1vqd2MTA++FdLCgFd3Eg8z1/qJtVxN:5IZcIdsN9VGX77v00INdtdU5WtVz
TLSH
T1BA625B715C78AC37A9A3B246F44A3A138FF4807B9AC46F90A5FD6F1D05DA6AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b1d7ba03a2185f7adc774a537336ba63fa86d92ff7011bc1913c0c021e7ba103
MD5 7a382967753052b3cd6d6422316bb5dc
SHA1 97797e4806a32247b3c2a980ccfa545e1e3ccd69
SHA512 f7dfa7c947367ca2fb6c31ab9a31666a9522e595db5982ee7712111cde52f051a64e849403a53cadb018891be825b89466a8b5322440badfdbd3193bf080334d
SSDEEP 384:jUZcIDsNboGX77vLJINdtdU5Rav4ASTOt/sROK+Y4MkvtVz:uD0XdWBU5iPS9oK+Y4MkvPz
TLSH
T1A0A23AB1D8A55CF74496F4C9A942F6136DB81037C9CD8A0CE6F9BB3D315FAB82316812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7d6ff5e23598caf3427401d73d0be8f3a02e9a45941033341a8fb2ec59e9ace2
MD5 fe7cb6b3f238b1e0cff4e119c1094290
SHA1 393c08c183f1a4f422237b2015f347c07d00621f
SHA512 ea3203f90ab7cd3f132e554eccb396a9ba5923f59295598c669e269405d23045afbb6013072f7cd4938736dd10f7bba52cc19e9605e3175483709e157347cddb
SSDEEP 192:JBON46vMKvPQmiUyJbuhTA++FdLCgFd3E580I/qJU/u:JBON46UKvRsu+dtdUuWU/u
TLSH
T1FA120A31ACA89C27AE93B545F48A36135FB4916BDAC56FA0A6EC3F1C01DA75C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d8b616ea347074ba096373588a634df068910dc4d87e1b0978b11bf61cb45136
MD5 85ea0a22e5e951167bf951ffc1a0aecc
SHA1 4334d382ff2f680fa318b66fd47727e344cf24de
SHA512 b9a21e7afba71c18f12dcb748bdeacbc8957a8e6490dff707e56ee1edfea1891193c5fc753f3c8c06f387f79ee43119fc8333b286382e9c7a107352670226206
SSDEEP 3:MsEllllkEthXllkl2zEkl9R0:/M/xT02znz
TLSH
T1564404047FC01C05DD0050704013C354C375D435053157C334511433DCC75C00C41100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d4f018c-939c-45e6-bab9-f54465bcbcc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d4f018c-939c-45e6-bab9-f54465bcbcc8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e11f324bb6654b17a2006844efff89dda1d24bf09cd21d4ee5fa6b2b4e233c5
MD5 eb71dd41fc55f6dd2ea2c9177c65f649
SHA1 a61f6837e3ee6b4ed17d13c911a1e8925e82faee
SHA512 e1ed56aa23a4fafc20a784a0f67c42a54d7368eb06f21d3355e93ca07ff9cbbb8072446aff63bde4e3703aae45d56c12076ed0675fdaaec8343636671171744f
TLSH
T18E412758A6EA1144B3B77F569BF7B96D487BBD772E0AC45E10010D4E0562A40C8B1B36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/212-579-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/212-578-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/212-582-0x00007FFA99F40000-0x00007FFA9A4DF000-memory.dmp

Download

memory/212-581-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/212-580-0x0000000410000000-0x000000041023B000-memory.dmp

Download