hxxps://updater[.]s2x[.]dev/s2x/s2x[.]exe

Analysis

user interaction
yes
max time kernel
109s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
31/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://updater.s2x.dev/s2x/s2x.exe
Sample260831-w2evqsaa35

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	416	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
4184	s2x.exe
4036	s2x.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\s2x.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	msedge.exe
416	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326743213804924"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{066A6E3A-B93B-4015-BF39-6A7ECBD7E9AE}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\s2x.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4184	s2x.exe
4184	s2x.exe
4184	s2x.exe
4184	s2x.exe
4184	s2x.exe
4036	s2x.exe
4036	s2x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2248	5028	chrome.exe	80
PID 5028 wrote to memory of 416	5028	chrome.exe	81
PID 5028 wrote to memory of 3424	5028	chrome.exe	82
PID 5028 wrote to memory of 3424	5028	chrome.exe	82
PID 5028 wrote to memory of 924	5028	chrome.exe	83
PID 5028 wrote to memory of 924	5028	chrome.exe	83
PID 5028 wrote to memory of 4780	5028	chrome.exe	85
PID 5028 wrote to memory of 4780	5028	chrome.exe	85
PID 5028 wrote to memory of 1120	5028	chrome.exe	86
PID 5028 wrote to memory of 1120	5028	chrome.exe	86
PID 5028 wrote to memory of 2684	5028	chrome.exe	88
PID 5028 wrote to memory of 2684	5028	chrome.exe	88
PID 5028 wrote to memory of 2144	5028	chrome.exe	89
PID 5028 wrote to memory of 4716	5028	chrome.exe	91
PID 5028 wrote to memory of 4184	5028	chrome.exe	92
PID 5028 wrote to memory of 2916	5028	chrome.exe	93
PID 5028 wrote to memory of 3248	5028	chrome.exe	94
PID 5028 wrote to memory of 1756	5028	chrome.exe	95
PID 5028 wrote to memory of 4036	5028	chrome.exe	96
PID 4036 wrote to memory of 244	4036	s2x.exe	97
PID 244 wrote to memory of 3948	244	msedge.exe	98
PID 244 wrote to memory of 4736	244	msedge.exe	99
PID 244 wrote to memory of 4784	244	msedge.exe	102
PID 244 wrote to memory of 4784	244	msedge.exe	102
PID 244 wrote to memory of 4148	244	msedge.exe	100
PID 244 wrote to memory of 4148	244	msedge.exe	100
PID 244 wrote to memory of 4148	244	msedge.exe	100
PID 244 wrote to memory of 4056	244	msedge.exe	103
PID 244 wrote to memory of 4592	244	msedge.exe	104
PID 244 wrote to memory of 4056	244	msedge.exe	103
PID 244 wrote to memory of 4056	244	msedge.exe	103
PID 244 wrote to memory of 4592	244	msedge.exe	104
PID 244 wrote to memory of 4592	244	msedge.exe	104
PID 244 wrote to memory of 4388	244	msedge.exe	105
PID 244 wrote to memory of 1952	244	msedge.exe	106
PID 244 wrote to memory of 4388	244	msedge.exe	105
PID 244 wrote to memory of 4388	244	msedge.exe	105
PID 244 wrote to memory of 4788	244	msedge.exe	107
PID 244 wrote to memory of 1952	244	msedge.exe	106
PID 244 wrote to memory of 1952	244	msedge.exe	106
PID 244 wrote to memory of 4788	244	msedge.exe	107
PID 244 wrote to memory of 4788	244	msedge.exe	107
PID 244 wrote to memory of 1872	244	msedge.exe	108
PID 244 wrote to memory of 1872	244	msedge.exe	108
PID 244 wrote to memory of 1872	244	msedge.exe	108
PID 244 wrote to memory of 3840	244	msedge.exe	109
PID 244 wrote to memory of 3840	244	msedge.exe	109
PID 244 wrote to memory of 328	244	msedge.exe	110
PID 244 wrote to memory of 328	244	msedge.exe	110
PID 244 wrote to memory of 5652	244	msedge.exe	112
PID 244 wrote to memory of 5660	244	msedge.exe	113
PID 244 wrote to memory of 5652	244	msedge.exe	112
PID 244 wrote to memory of 5660	244	msedge.exe	113
PID 244 wrote to memory of 6100	244	msedge.exe	115
PID 244 wrote to memory of 5284	244	msedge.exe	116
PID 5284 wrote to memory of 5300	5284	msedge.exe	117
PID 244 wrote to memory of 5584	244	msedge.exe	118
PID 244 wrote to memory of 5584	244	msedge.exe	118
PID 244 wrote to memory of 5772	244	msedge.exe	119
PID 244 wrote to memory of 5772	244	msedge.exe	119
PID 244 wrote to memory of 5992	244	msedge.exe	120
PID 244 wrote to memory of 5992	244	msedge.exe	120
PID 244 wrote to memory of 3752	244	msedge.exe	121
PID 244 wrote to memory of 3752	244	msedge.exe	121

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://updater.s2x.dev/s2x/s2x.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3d56c728,0x7fff3d56c734,0x7fff3d56c740
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1824,i,2132157821025869991,4920063384259255240,524288 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,15344728572014938958,3084373117369394685,262144 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,9395872676276772800,8538177266156727842,524288 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,12486615290914584323,16542045658570657233,2097152 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,12531810205727994534,13381204642287969820,2097152 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,8041255353143006390,13166806769695412558,2097152 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:9
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,14574206052053492959,15294578250926260904,524288 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,6323389041412155939,2381738298750396717,524288 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4716
- C:\Users\Admin\Downloads\s2x.exe
  "C:\Users\Admin\Downloads\s2x.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,4524643903694382179,10327986464124748405,524288 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,17423967620767044837,3788316386898052024,524288 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,13981410790000167281,17250511970850100996,524288 --field-trial-handle=2068,i,18252887692443624089,16795335060900036250,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:1756
- C:\Users\Admin\Downloads\s2x.exe
  "C:\Users\Admin\Downloads\s2x.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Brentdevent/S2x
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x31c,0x7fff27efc188,0x7fff27efc194,0x7fff27efc1a0
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,1459126525946385724,8934932845388048767,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
      4⤵
      System Time Discovery
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,6260891927216898794,6915918816583290396,262144 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,5086242961367891416,3769960435288053783,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,2825236401113212897,11239017863769401673,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,391608587250413290,12845585199888244528,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,4144889966850400218,3905489107015276192,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,5479387774966706837,12886268723866813981,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4328,i,7136392942698480187,15501421241489923177,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4352,i,6699676254009585869,4284934572108113905,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,7967328737502908740,10149235083453665303,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2241290016711250136,3086778022321814229,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
      4⤵
      PID:328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,5370674479531567631,4308926913283066586,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2636664448889481001,17350171019315750485,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,13789675182718076283,9402748938794172378,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,13789675182718076283,9402748938794172378,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,14721244350139223503,15527264785217570364,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,5045500440207289264,5400353179672873986,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,2985735883894487244,18216779136352308606,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,11562649586330414150,10235269327797828193,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,16277122224755125927,14350839706423511337,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,4272602808382082618,5327858281726056696,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,8797611187100867398,10784161163765918186,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,2752629010218767892,15529164560989281313,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,11879274387222553782,3573013794322259433,524288 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4496,i,15226668554692479689,15082719642328714902,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3752,i,1209599892622230510,5832112464198129320,2097152 --field-trial-handle=2124,i,6044527378209110463,1518085239556548282,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
      4⤵
      PID:5580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c7a12c017b8e4ad1a4f86cf07fc2c107abab0ed280583a2988762d18c19e86f6
MD5 6271d61b3d2e43500f46313a2c8e82ff
SHA1 ad0cd2090d9ed9a2933deaf7fe00036fae7dfeaf
SHA512 d71e8c4e630c5acb08b29d174927d29f76e45361c961d92417bea1bdbdb6beaa7cac45becc02745a735b803a4cfc0e8467a924547b89e8c2b44bfa5ab78c99b7
TLSH
T14DE02BAADD22FC3B0DFD275960500B47F75013172650490F3A3C91198FB553745C6D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 073cd12632f4e5cec8297ba03bd4e704d2cdac62a4079aba908e0a26d30873a0
MD5 ed393777a7cd57c555367be2c87dea0c
SHA1 1ca626b851d1e45ec0df84f6fa9dc8b2852967be
SHA512 4d43ad539707bfb5c3a32ecda937b7b0a798786879a5d1e8466010f938328b39be9794fc1fa4ecb566d027582857341118279214b096c2d6bcdef2e08ca606ca
TLSH
T114419DF793F4857E8A1192F4EB156F2FCE6A0524131C3C6688D46E1B43F2872E20478E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7ce72e2b0362dba113a094c6550c59ddcb8f1bc3e5266c4e1539ce19bb23c3ec
MD5 959bfdc5c0b2b0082de32d2209ddfab8
SHA1 9c31665a9d1a1855699541e4b330b0328840b863
SHA512 48d9eeb5eda69b747b783de8c3262696fe7b42192101213dfdd7fc1cf448c9075b39957d610bac9e67c6bd7f1a89f58449d9890f388ce9890c2fb62089e35996
SSDEEP 192:pRuDVOSqxQEq9v75pAPRp2A98Hsb+WNnAEOPzkG0RJ1+VyIsnAUge:pRuDhh9VUXLuwWPDM2e
TLSH
T18042B62EFD14697B5CCBC22AF9267B67D7F6102124901E84E6FCC92C28E79CD221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 99e2a315106ffeed0f94f8946e6087a899b533f9d433bd365f03f1a33f7478f6
MD5 c715411c584e0269ebd0623cab41539f
SHA1 bbbdf6fd728bcf4fe8a1e7896d46df082405446a
SHA512 be6a79b818b0eeb0e5c849de813916629d57329ffaf136e9f698da1e13abef19b08c036a30e465ddb939cf5b5b4b26a5318dc0c15d4eaaf700cc94b30c4baf53
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLILc2jwxXODuh+ErU37sH1vZy:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17p+
TLSH
T19072FA677C4C8E770FD4CA8CD9277F4FADB5024A55E9C86442FA9C2503D5ACA110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2ad29208a1a6d1b1fd441ce68b7636f6a2ac9d7ee05b5c2f3127dd4e65bd0348
MD5 19bfab44dd6d6193d49c824d41beac02
SHA1 c5e5b893d809b18fdd2d82ac4d7918f9b3d790dd
SHA512 91db5e31f314bc6fc14f25068bc2415dbb55511c1b2614a6bb73928c3ab4fe182632fb17840156e428c320c0c52ab7b9cb7c022958c89201b8341c289cea4fc5
TLSH
T104B01212C0016202C04B02B02543148871145F18961E170683E86E32C825171C414092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5909ab.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5909ab.TMP
Size 96B
SHA256 fef7542dcd9becb3710a0908c2444bae62ac79a95f7533192b3dcee8e88718b3
MD5 bd8bcf98d5111ff65308165a4a4fb0c4
SHA1 4c3abcc4623187667e66b61ca928e838fad7ef3e
SHA512 f5d69d96184a28db8d58284dd501748abc50d66374b45e0c84495e7ee5659191d8ce5c4689af22aad3c86898e20076e91d681aacd865bafd84a2c59926c9bf3d
TLSH
T10CB02233C002B202C00203B02282A0CC3020CF20C2230202C2F00B2BCC303308828020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 afc1ff41ba63f0b1ec443d3811caf7691cb9a2f4ad37f4d1add281b144b7ef4d
MD5 a479d942c5dad554cad7dcc8c1040d1a
SHA1 9ca65070259b83a8bf52afa931807fff9629a338
SHA512 5569dc56f984879eb2f4d21a45fa7947d006a198e1a0f7ed8ac8c51223e3c053f90f16ff54486c4b665c9a105afd16e9cec9600e5d1c9584b6d0e491b6f50add
SSDEEP 3072:l3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:l2m7Rkm1tYpBeh2BAoF
TLSH
T10EC312375DB5E87759B5BB1EB04E0A1F1EF149A3CD20DE92C8D85A0433EA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d83a30ca13d3ef475a8ff16e0c28e87a3514725f427ea721b5d6f50d3451a34e
MD5 ce5a9d840f455f01a3bfaf959d5043f3
SHA1 8fddf40c0589095ada0bdb4e423a52b559531c74
SHA512 dabf0c316a852662a2b2fb17fa063bdcad5e759b2aba6e0ddb8ad5d2741814c220fa60f65b4ab4d08452029914b1c006f1fd3738bff9848de5eb56d33d409b06
SSDEEP 3072:yGGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:yxm7Rkm1tYpBeh2BAoF
TLSH
T1EDC3123B5D74A87749B9BB5EB04E0E1F1EF149A7DD20ED91C8D85A0433E9BCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0c3033255a26bb13676d3d01882bff187a30c36b6bb3be5e0c11cc4a75f56748
MD5 f3663b88e44b9a7961d22cfb49acfeba
SHA1 005f31f6c3b6c9f8f6777e45f896dec9ee4fed01
SHA512 d64b71b561c6b0411985f8650f709cbd058cf736eaf49b9a0805c32b053eb108b72efc2b5011b302704177a83c27bc210df871c2680dbdab8c999b3db34645a7
SSDEEP 3072:i3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:i2m7Rkm1tYpBeh2BAoF
TLSH
T1F3C312375DB5A87759B5BB1EB04E1A1F1EF149A3CD20DE92C8D85A0433EA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e6e5f4c481460155b28e9cee960469b99a26733b7949c53a73baa36240c2dafa
MD5 9fd4a45a0534aa810b130f4084e00f02
SHA1 a0125f5c342f39933f40df80bdb3152c48b64152
SHA512 1b0b2e684a447ad863376abac98a302db442de0252336d58ead96161e45fdc5c0c004c65f09e27e4816ea9444c09a83a91ba0f6c7b9d70658da3b40f40d7f7b3
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:em7Rkm1tYpBeh2BAoF
TLSH
T146C3123B5D70A97759B8BB4EB08E0B1F1EF149A6C930DE92C8D85A0477FA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7e8eb5468eb68b1fa0b3e8edf27875a861602d46ee8dab1404507968b5ada3e
MD5 2d8972f0ae8d9fa9f8e8538a8f938fee
SHA1 6ccf5c97711c8b13385d6b1393afe80ad9cd582f
SHA512 a424e6cd13920205aa69679903670a25afce321199150dd5953a021ed922f6c14bb7dd0afc9d31730ab95a1f1a16f03353e4af4e0aa17f1a98d8d79743f7bf9c
TLSH
T135D023205DACB5D1F626153C45334710369D85473957910BB111050D8C7644293D8C9B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 121KB
SHA256 85f8ccfe556d6bfe9a1a71586094062c4712c33a003ad60d7b2c02c77b4bec2f
MD5 52d86989000a121c272c78511c198921
SHA1 7d95ebf9df4f29f3695ea43fc753be2897419959
SHA512 c30e249573ab43bef24cda4fc525c7deab668dd87e85535107f8b275ac301f700ec2499046e329a9ffdcf0829e92b7341563e48f96cad6d6da500f694f6dd68a
SSDEEP 3072:AeXOViEoMgJ8XOhdFeTadlDVfyEQ5Kstx8VnGkF/rCf:xeVi/nFwa3BfTstx8VnrF+f
TLSH
T18BC312007BF9BC83C1D312242EC106284AB6CDF9F64E995352D7266B1BAD6F2098E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 94e6568adfed9fe5d5cbdc9b4be292fced773221e644ef2ce15dcf7ac09b0daa
MD5 841aca023174e3244edc6c23448da9af
SHA1 82218974c78e2a078efb52c362a82ca67d363c51
SHA512 27e3a3d3fe99d52f6522b8c5b9cccf548b4c27f4f1589846a74788cd4400d22ad6b7e270a5765fd1e572583ede3f8e554419f589b125bad43ebd1681a9404709
SSDEEP 96:cLXA8ikuVsnKvNqqjDIi+LSNqDGyKLuLVlZUYP4CgoZRGHpBM:cLQ8iDVQIqri+2ofuuRlZFPX0pBM
TLSH
T12BC128BD249E0E63F3550E3CD0C2DE8E3B7C91AA097FBE21B0D458B5C611F1149496B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 148245018f4f727cb64027ae79fee5f135f51d03c1e2dad2af6113d02eb3f6d7
MD5 8b2cb85f87f5e02435eb7f9fe945d10c
SHA1 09d2e48209458b3a824f43ae216086072e1c628d
SHA512 57350512894159aa39a673ee30dc7deed1328257da56ead651116b3360fce56a7b4c80f406978b6962a514ee2fe4a219be5f56eadf0dced19f765ed6052ca314
SSDEEP 96:MoMA5yhFrSrsq8KvXqfh8DqiLSeUmQCGXDhLHLkOdZzzgbIVUGt44CgoZQG9Bo:Mot5yhFouiqfLi2eMCmRHxZzEYVOXlBo
TLSH
T188E16FBD279E0963F3140A39DC829A8E3B78919B097FAE25E0F45CB3D501F1179486A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59d306.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d306.TMP
Size 3KB
SHA256 9524adbcbc7913e73ebe71e66d664faa8d1da619cea030d24fc3650ceaa0d604
MD5 5ae4cb6c6e4534b7adb4d48b97ce7055
SHA1 63d9e9f843e53c5ee852e7b6ed99818a9e7e2621
SHA512 98df72ff4fd81857f569c9f96551d6491eb7750715927caa9e550ba73cc4a6afbf592ab4a9fb7252fc47ef0b41394938bb24b6f9e5f90d36c23185fde03c08dc
TLSH
T1137128FD36060173F3690230D4835FCE3BB082AE096FDE75C2A44CB6DA12B118D4578A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 be19e625d44021ea363f411e317ae844e0a69d37069f90d3e692f8c33d58c823
MD5 34269a3ede459bf43ed76240f36a4cc1
SHA1 6e10ebe3abcbf047138882f663fd7eb5e012820b
SHA512 69ba37fce4f1c805a29a5f87b5b6f2be45c96d67029e2513762d64975e22debf7290b307f864f41b4d5d1ffd14684bcbabb605aa3998d6a6e55ce02ad232dd03
SSDEEP 3:MsEllllkEthXllkl2zEklDlt:/M/xT02znD
TLSH
T1284404357FC40405C70510704131C3D00370F4101D31574374D10533DCCD5400C01001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 60118b099fac9117b71c2842724b1d3d3ccc52e508627169d30678216a62cc12
MD5 36cf0c1746cfa002ed1fad6b5a19d83f
SHA1 7d6879773768e34d31c4decdde57a1c006e60fab
SHA512 ab3e9d71a6cc53d940d8c0d3c661483b72a7be2e40715e7cbf03d3e82f9a238c04cee66b909a5ee198ede767e0f5fba45b538895b6de689b901c2c6cd89920f3
TLSH
T10851ABF387F5966D8A0295F0EA18AE1FCE2D0524832D3C6A85E46E17D3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 92977fdc7019ba458f38c9cb107ed5398d95255da361f6181980a93b50eaf31f
MD5 9926a46793cac0c6c4f4bd9b3a9df8d5
SHA1 13e37e7d3ed69a95417c65f6acab4df157d2ff03
SHA512 3c6c4daeb1a92a1ed03ddabdf78ae124788573e6e1151ef4a079d299cdd05d41a1bf246f8548de3f1e13d23c2d51b29bb5b345752cc45ea2fe8bd5671a47da9c
SSDEEP 192:sxZY/ywFaKOMl8MFR/fnsNKV58G6lIDIupsv1/W6+WNYyx/Y0uBHUjBkIgUPJ:sxZYXdR/fnsNKo1lIfi/bb/5u7UR
TLSH
T179520A166E64A9B78CCBD21EF985BB53D3F55462E5900E44AAFCC61C00E67ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d5cd2d6b7664687e8aed002c8cdca16fb0e1d050b89766839f6e89cb2b527a2e
MD5 b47e658040009e15dffc88a40afdeb28
SHA1 0ba85e7befed8d04a50aa26849396cd54eebcef5
SHA512 41bc8dcd9c38dddfcad7a88189ed71f56c536a1eb34562d27171a728e4590081662c02c71700da7db1f2dab602fc1cf63abe9070cd59eaedbfe7bd6593dca6b6
SSDEEP 192:sxZy/ywFaKOMl8NFR/fnswWpVB5V58G6yIDIupsq4q/W6+WN2RVJG3YfwuBn48Jl:sxZyXmR/fnswWvB5o1yIfP/bH3/u6Qf
TLSH
T1B562F8126A2459BB8CCBD21DFA85BB53D3F91423E5900E44AAFCCA1C01E67ED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0dee79821e59c4a7bcea4e478d3181ad4e1fe05fb249709ab2285ab11b1f6c98
MD5 18f816e83c94094a213a60214a3cb579
SHA1 b9ee88292378dc891811b619b35aca18247d579f
SHA512 05a614d8536beb6a9cdd13791a897c9754200709f648951559b73320792de23be517d1bae8cabf2a0b07de4804192092d40ad714e25911a3bc9eaf5641bd9044
SSDEEP 192:sxZy/ywFaKOMl8MFR/fnsn5V58G6lIDIupsq41/W6+WNLIelZYfwuBHHxBkIg58R:sxZyXdR/fnsn5o1lIfI/bbZ/ueaR
TLSH
T1BC520A566A3459BB8CCBE21DF945BB53D3F55462E5900E44AAFCCA1C01E67EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 be0a26c2e5143f473cf45289e707b554e551cf35984a5a49994b7c3c6d22e135
MD5 5525f2ab730cf582afd737f9a5141ddf
SHA1 b50c186fa0be24c14cdc53122fca54cee9b3a087
SHA512 561f25a47d77be92a05713a9f4d99cdc261019623a0964007b09feee0e0b2e5e6de1af06dd054165592eb82a6ef6db98f32057476b971d3807a7eda5767a776e
SSDEEP 768:8F/Lh8dF2yS7pLILtAkWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3LVLjLli:8F/Lh8dF2yq2tAkWRmAcQ3wu1jaKLVLk
TLSH
T147F21B3B690CCB7E4F844E9DED2A7E8B6EE801CB5698895447FA844C03C66EF41161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ea83320953dab46983938ee370cb95b12128596073066d9134594638f51b2e08
MD5 1ae4188f3734dc78eb07e5944acc14f3
SHA1 0ceeb5f5f6ae55ba5dd38113d138b6f2dfe8d491
SHA512 5dd3236eec37f08318e1e56580173e576b4be348be9bfb17125d097e2afeec8f383fcb5819e47560086c3acb4d48d4d675b9b3f4f1061b2bba181f23b46e5725
SSDEEP 48:K08I/KFGsPGIfKLy4zyh6IPKPqk6c0cncIcUcGcOcOc+Uc+cJcD:K08gKFGSG0KLymS6oKPqck
TLSH
T1DF91001371BA06027D3E661C8795976A8E4676A73019A52F3FFD00B60EAEE114CFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 29f64eb3c0c2b216c1048cfa32e7d1327593b5cab85acef7450c9059d82fb6cd
MD5 10a06b0ea34fd67fd7ca84aad97abdc2
SHA1 a64219c0afd5c6d6b1164a8c2f9813c1323f5025
SHA512 5f7f47fc44443da4d20382413304d448343d92f7ebd597e26cbb8c7469ba6920074280683e824357fae37b8dc4e68ef4c2ba6770f5d98676230aa546e1a4400f
SSDEEP 384:nwZcIh8Nhk3W040HFeci0Fptu78+bPiXIcCY0X1puL1noJ:OhfWCltJbwPahCYsyLxa
TLSH
T10B827C316C78AC7B65F2A549F18B36179EF85037AAC46F44E6E89B0D00DA288170ED17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c23448580461c32dafb3b1e3cae306381a564b4a6a589f53599bff5c98c1854
MD5 b3b1c11e3ae978d061cdd21cea05c3ec
SHA1 378909a6dcf1365f98788885f8d10388ad41e576
SHA512 5efe88c56df80172eedbda47ac69249cf9cee91e1e086d54dbeee3d515349868fba5d282e58673c6c14ffb3a04b9cea82d25aea3f1ce2bcfa354f1f3f5f8ea43
SSDEEP 192:ETGNc6d940tjQmiUySM+BF2oP1uLjzor+BVnPiXIOiDwqMRU6:uGNc6740fI+BFptu78+bPiXIjYU6
TLSH
T17912E831687CAC6B5E927549F0873663ADE5117BED84AF44EAE84B1C04DB38C274EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53a0ae7fccc526fa161430f34d28f6a0e7dd2817d64a9b1c4819dffbe9622c30
MD5 2c9b27af3dbfbaddad9dc0ee792e225b
SHA1 94dcce65ed727a702257c89d68a192e1d26b9b1f
SHA512 1a395f132509bddd55abd18239a66a9085504528b4e5496b974668aae54405779cfc8007a5baa70c1d8fa2147ef3f899ccf02b208da1c1d60fe592a5f1bbb09f
SSDEEP 192:qGN/6d9402QmiUyuvMTBF2oP1uLjzor+BVnBGwoWplJU6:qGN/6740SJUTBFptu78+bXJzJU6
TLSH
T1E502D9356C383CAB9EA26E49F44737136FE5112BAA846F44DAF41B1C01DB28C1347926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a95028bebc863554965b5a3137946b4a7caf6874f3769b22607b5a4be7f8a1ca
MD5 c54968be8bc5dd3328ad8b4cc86831c1
SHA1 6bbef51116d0a51d274cc40fa5cb411343c48390
SHA512 af2b86e3cbc21aa888f851331a92c30367dbe11d8f55a9cac38c541f2a2ab1a4f2903fe41e5ba99b34922dc8393655b659ccaf78e9730af7136227f1313ab9a0
SSDEEP 768:YhhWClIJbwPahCOkfNB1KGik3FudsyLxa:YhhWCmbwPk7k1B1Klk3Fud9xa
TLSH
T137B24A7D9CB45D3F00EEB748A60E39275CB8813BD6F4AA48E7E8470DC1BA559F306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 58b0f10ae610483b237e54e3f7f548c2fa8547cbed0f19648e8026be0f602247
MD5 c2734fb0d088f9c9033586a40d408bf7
SHA1 1ad751267762605aafb66e8f90adeb94789dcbb5
SHA512 1a38410211210643a2585f78b240e4a5635ee7e45cab9bcc727aba9998656c5fc6f330cfced4469212dfcfd16118501dfbe4fbc4eb208878286f9b58f976cd2c
SSDEEP 384:nZZcIh8NhX3W040HFeci0Fptu78+bPiXIcCY0X1puL1noJ:xhUWCltJbwPahCYsyLxa
TLSH
T112827C716C78AC7B65F2E549F18B36179EF85037AAC86F44E6E89B0D009A288170ED17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62b916e5-65dc-486c-8115-d7aa1981f4fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62b916e5-65dc-486c-8115-d7aa1981f4fb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

661a86ea-5a94-48c4-98b6-157fcd76c2ad.tmp

Path C:\Users\Admin\AppData\Local\Temp\661a86ea-5a94-48c4-98b6-157fcd76c2ad.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b47b98a3-f3e0-4171-93e7-c980973270a6.tmp

Path C:\Users\Admin\AppData\Local\Temp\b47b98a3-f3e0-4171-93e7-c980973270a6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir244_1017667745\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b318ed15-5011-4940-a73a-ac5377fa159d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir244_1461497923\b318ed15-5011-4940-a73a-ac5377fa159d.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher-options.txt

Path C:\Users\Admin\AppData\Local\s2x\launcher-options.txt
Size 10B
SHA256 7c98a64afbd77341bcc70e4cfc4ef9a0e9d0309d59bc8d4f16f364afcd256fc6
MD5 cb85d16235d10505c5c2c9d71bca44c4
SHA1 6c83b168b10f89ebe26587c8f8c8073ffe8f1821
SHA512 c435582ae18fbe8536fe7ff898edb9d46f73a035e3dccdedd2238bdb20e11f4a4f6efc4abe6e7032d2af01283764c86d55f1ad4245972dca6800593ed438d583
MD5 SHA1 SHA512

Submit Download

Sin confirmar 714879.crdownload

Path C:\Users\Admin\Downloads\Sin confirmar 714879.crdownload
Size 4.3MB
SHA256 9f601b97357c2fd5b5c0377e93e19ed74b7a0e17ffa9ec4b072ab9b234b205ee
MD5 875fef70a42e895b43f1a3bc589292c5
SHA1 6912e326e5583ff344d2464f9bb94b6fc1e4beab
SHA512 808e27bd3cbcf4a574a504e9df040c14e3a3e69286b484b1be2b4551e348bd57cd85bc5b8d5c2071df7a4b9726a4f932296e4d3ed1914a423355055ba7e51cc6
SSDEEP 98304:25w5KcRwbeltZYWapaNsEiwUKRjBAYB0QDS/w+o:BR1AIb2IL
TLSH
T10626AE07BB9821A9C1AFC6314DBA8B6BD3B3F0102772474BA75D56749F933E01F0AA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s2x.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\s2x.exe:Zone.Identifier
Size 71B
SHA256 19ed7590948b13e0d62b07cee608510333efad6a08c2383387233c4c0551a887
MD5 aa96a62e16f4d906959444bb59643d78
SHA1 f18b026b39d8813c411bf6cfe566e89d91d57435
SHA512 1ed8c1502d24a0e50d90fb173a82f16916eb1fa902a9b340da0df6dde5591782915e14d408cd23943f1dfb6b0936025e389121fdf095f37162406470244fe9f0
TLSH
T1D1A022C30020A808032C30C822ECA30CB80F3C038CC20280EC8200CA8CC808F02FC00A
MD5 SHA1 SHA512 TLSH

Submit Download