darkcomet | hxxps://dosya[.]co/lm01v6loga3b/pirn[.]exe[.]html

Resubmissions

09/09/2026, 23:32

260909-3ja76abn4y10

09/09/2026, 23:28

260909-3f2wpsbn2v10

Analysis

user interaction
yes
max time kernel
311s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/lm01v6loga3b/pirn.exe.html
Sample260909-3ja76abn4y

Score

10^/10

guest17 discovery darkcomet rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest17

kgiuaoc0lq.localto.net:3925

Mutex

DC_MUTEX-8RUY27A

Attributes

gencode
N22pvmYbXjg0
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Downloads MZ/PE file 1 IoCs

flow	pid	Process
99	1952	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	rundll32.exe

Executes dropped EXE 32 IoCs

pid	Process
2384	pirn.exe
5060	pirn.exe
2508	pirn.exe
3168	pirn.exe
2868	pirn.exe
3680	pirn.exe
5412	pirn.exe
5456	pirn.exe
5500	pirn.exe
5800	pirn.exe
4164	pirn.exe
5468	pirn.exe
1252	pirn.exe
3628	pirn.exe
1516	pirn.exe
2284	pirn.exe
3800	pirn.exe
5168	pirn.exe
5268	pirn.exe
2036	pirn.exe
4144	pirn.exe
5084	pirn.exe
5364	pirn.exe
4044	pirn.exe
1060	pirn.exe
2612	pirn.exe
5844	pirn.exe
2496	pirn.exe
5592	pirn.exe
2572	pirn.exe
4388	pirn.exe
3484	pirn.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pirn.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1952	chrome.exe
3012	msedge.exe
5668	msedge.exe
1060	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334705199606498"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{BAF25FE3-3066-47B9-836F-66A88C0E82D0}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
644	chrome.exe
644	chrome.exe
3384	chrome.exe
3384	chrome.exe
5508	sdiagnhost.exe
5508	sdiagnhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
4596	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeIncreaseQuotaPrivilege	2384	pirn.exe
Token: SeSecurityPrivilege	2384	pirn.exe
Token: SeTakeOwnershipPrivilege	2384	pirn.exe
Token: SeLoadDriverPrivilege	2384	pirn.exe
Token: SeSystemProfilePrivilege	2384	pirn.exe
Token: SeSystemtimePrivilege	2384	pirn.exe
Token: SeProfSingleProcessPrivilege	2384	pirn.exe
Token: SeIncBasePriorityPrivilege	2384	pirn.exe
Token: SeCreatePagefilePrivilege	2384	pirn.exe
Token: SeBackupPrivilege	2384	pirn.exe
Token: SeRestorePrivilege	2384	pirn.exe
Token: SeShutdownPrivilege	2384	pirn.exe
Token: SeDebugPrivilege	2384	pirn.exe
Token: SeSystemEnvironmentPrivilege	2384	pirn.exe
Token: SeChangeNotifyPrivilege	2384	pirn.exe
Token: SeRemoteShutdownPrivilege	2384	pirn.exe
Token: SeUndockPrivilege	2384	pirn.exe
Token: SeManageVolumePrivilege	2384	pirn.exe
Token: SeImpersonatePrivilege	2384	pirn.exe
Token: SeCreateGlobalPrivilege	2384	pirn.exe
Token: 33	2384	pirn.exe
Token: 34	2384	pirn.exe
Token: 35	2384	pirn.exe
Token: 36	2384	pirn.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
5548	msdt.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2384	pirn.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 1984	3384	chrome.exe	85
PID 3384 wrote to memory of 1952	3384	chrome.exe	86
PID 3384 wrote to memory of 2856	3384	chrome.exe	87
PID 3384 wrote to memory of 2856	3384	chrome.exe	87
PID 3384 wrote to memory of 3772	3384	chrome.exe	88
PID 3384 wrote to memory of 3772	3384	chrome.exe	88
PID 3384 wrote to memory of 836	3384	chrome.exe	90
PID 3384 wrote to memory of 836	3384	chrome.exe	90
PID 3384 wrote to memory of 4848	3384	chrome.exe	91
PID 3384 wrote to memory of 4848	3384	chrome.exe	91
PID 3384 wrote to memory of 2200	3384	chrome.exe	92
PID 3384 wrote to memory of 2200	3384	chrome.exe	92
PID 3384 wrote to memory of 472	3384	chrome.exe	98
PID 3384 wrote to memory of 472	3384	chrome.exe	98
PID 3384 wrote to memory of 3976	3384	chrome.exe	99
PID 3384 wrote to memory of 2868	3384	chrome.exe	113
PID 3384 wrote to memory of 5040	3384	chrome.exe	114
PID 3384 wrote to memory of 2780	3384	chrome.exe	115
PID 3384 wrote to memory of 644	3384	chrome.exe	136
PID 3140 wrote to memory of 4596	3140	msedge.exe	145
PID 4596 wrote to memory of 3056	4596	msedge.exe	146
PID 4596 wrote to memory of 3012	4596	msedge.exe	147
PID 4596 wrote to memory of 2760	4596	msedge.exe	148
PID 4596 wrote to memory of 1824	4596	msedge.exe	149
PID 4596 wrote to memory of 2760	4596	msedge.exe	148
PID 4596 wrote to memory of 1856	4596	msedge.exe	150
PID 4596 wrote to memory of 2760	4596	msedge.exe	148
PID 4596 wrote to memory of 1824	4596	msedge.exe	149
PID 4596 wrote to memory of 1856	4596	msedge.exe	150
PID 4596 wrote to memory of 1856	4596	msedge.exe	150
PID 6112 wrote to memory of 6092	6112	msedge.exe	159
PID 6112 wrote to memory of 5668	6112	msedge.exe	160
PID 6112 wrote to memory of 5960	6112	msedge.exe	161
PID 6112 wrote to memory of 5004	6112	msedge.exe	162
PID 6112 wrote to memory of 5960	6112	msedge.exe	161
PID 6112 wrote to memory of 5960	6112	msedge.exe	161
PID 6112 wrote to memory of 5004	6112	msedge.exe	162
PID 3384 wrote to memory of 5664	3384	chrome.exe	166
PID 3384 wrote to memory of 5664	3384	chrome.exe	166
PID 3384 wrote to memory of 5208	3384	chrome.exe	167
PID 5864 wrote to memory of 5856	5864	msedge.exe	173
PID 5864 wrote to memory of 1060	5864	msedge.exe	174
PID 5864 wrote to memory of 4784	5864	msedge.exe	175
PID 5864 wrote to memory of 4784	5864	msedge.exe	175
PID 5864 wrote to memory of 4784	5864	msedge.exe	175
PID 5864 wrote to memory of 6088	5864	msedge.exe	176
PID 5864 wrote to memory of 6088	5864	msedge.exe	176
PID 5700 wrote to memory of 5548	5700	pcwrun.exe	200
PID 5508 wrote to memory of 3020	5508	sdiagnhost.exe	203
PID 3020 wrote to memory of 208	3020	csc.exe	204
PID 5508 wrote to memory of 4540	5508	sdiagnhost.exe	205
PID 4540 wrote to memory of 2304	4540	csc.exe	206
PID 5508 wrote to memory of 3444	5508	sdiagnhost.exe	207
PID 3444 wrote to memory of 6000	3444	csc.exe	208
PID 5548 wrote to memory of 5720	5548	msdt.exe	209
PID 5720 wrote to memory of 2496	5720	rundll32.exe	210

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/lm01v6loga3b/pirn.exe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffecbbec728,0x7ffecbbec734,0x7ffecbbec740
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,12976649850687764366,11634725875390053428,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,13472494672197823105,4996745019224722668,262144 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,10059077978003241326,17019486138598885257,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,1832951899380049796,13090987133967337248,2097152 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,18295930482042693588,10364683347669949266,2097152 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,6701288713040720418,223383921841074027,2097152 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,10210408220293604553,17806238127757446088,2097152 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,5763196708790962100,18280444077922923053,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,11915807975114360042,849608707614218831,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,15752919361441418556,7586107566536139987,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,17667018885246955084,14583293155019076165,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4316,i,8256059591454814550,1050043106545185806,262144 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3144,i,10240022231786101531,15570567046632228095,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,12819367582177001712,6798009184842659643,524288 --field-trial-handle=1984,i,9398393041739369368,11917337080766355039,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:5208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2380

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5060

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3168

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5412

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5456

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5500

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5800

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4164

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5468

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc6d32e13h730ch46daha3d4he728796ce61c
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc6d32e13h730ch46daha3d4he728796ce61c --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffebb04c188,0x7ffebb04c194,0x7ffebb04c1a0
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,2104172598340516177,14681423380564454899,524288 --field-trial-handle=2604,i,3470201629378055693,6906375303147481388,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,12728647601549350797,15908617126798156036,262144 --field-trial-handle=2604,i,3470201629378055693,6906375303147481388,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,13127917780416852985,14301561093091971158,524288 --field-trial-handle=2604,i,3470201629378055693,6906375303147481388,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2500,i,10772604726211846858,13871537683495597761,2097152 --field-trial-handle=2604,i,3470201629378055693,6906375303147481388,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:2
    3⤵
    PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault04de9150h4e19h4b3dhbdadh10a5d7284278
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x30c,0x7ffebb04c188,0x7ffebb04c194,0x7ffebb04c1a0
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15102656139325277511,6749866267566512430,524288 --field-trial-handle=2368,i,15555558658078322436,13679645891042817767,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,9831162090766003120,16012524640283570747,262144 --field-trial-handle=2368,i,15555558658078322436,13679645891042817767,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,12334943838253589048,12080410379734900123,524288 --field-trial-handle=2368,i,15555558658078322436,13679645891042817767,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultac9ae4cahf8aeh4574h839eh329b810c2a75
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x30c,0x7ffebb04c188,0x7ffebb04c194,0x7ffebb04c1a0
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,12326005496716983262,15634559237441469255,524288 --field-trial-handle=2312,i,900823459351748848,2253940515890135759,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,8013952676804189875,15130559854699303814,262144 --field-trial-handle=2312,i,900823459351748848,2253940515890135759,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,1951209535358148417,389231793885787892,524288 --field-trial-handle=2312,i,900823459351748848,2253940515890135759,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:952

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3628

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2284

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3800

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5168

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5268

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4144

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5084

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5364

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4044

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5844

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Users\Admin\Downloads\pirn.exe" ContextMenu
1⤵
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\System32\msdt.exe
  C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCWD657.xml /skip TRUE
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Downloads\pirn.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Users\Admin\Downloads\pirn.exe
      "C:\Users\Admin\Downloads\pirn.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2496

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hoe3rtzv\hoe3rtzv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBB6.tmp" "c:\Users\Admin\AppData\Local\Temp\hoe3rtzv\CSC6EA58AFCBFBE4807AEBB15588BCE7FF.TMP"
    3⤵
    PID:208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4bj1zlsd\4bj1zlsd.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC14.tmp" "c:\Users\Admin\AppData\Local\Temp\4bj1zlsd\CSC9E1B9A31575340A38A731DB152B8FB5B.TMP"
    3⤵
    PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bi4hknju\bi4hknju.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE106.tmp" "c:\Users\Admin\AppData\Local\Temp\bi4hknju\CSC492FD7CA96684F1FB883BAA13A1CE33.TMP"
    3⤵
    PID:6000

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5592

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2572

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:6136

C:\Users\Admin\Downloads\pirn.exe
"C:\Users\Admin\Downloads\pirn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PCW.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2026090923.000\PCW.debugreport.xml
Size 3KB
SHA256 f101d436fbc43968bc98c98f0ddd65a40e8734fbb215c9fafbb6d7235d9c79b9
MD5 d3c5c6aee45d6ecbcf2b404d5f9a2d0a
SHA1 79c5434c199ed314f540f114f136fbf6638c71f2
SHA512 284f14db0f21c2a636701a3beb5a448d4580b0e60a17b65690edf918a1acef7474dd8fb2f5560dce73eb4cd8c77458efb9bfbe6ac164149b1f5298f27ea0f32d
TLSH
T153710B04A56E3FE0008A2B6365FCF5891D38922D22CDB1592CCF7A5A95DAF587F63311
MD5 SHA1 SHA512 TLSH

Submit Download

results.xsl

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2026090923.000\results.xsl
Size 47KB
SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
MD5 310e1da2344ba6ca96666fb639840ea9
SHA1 e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA512 62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
SSDEEP 768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
TLSH
T16723CCA4B09CDF394BB5716BD8F2A582F61BCC366B356091F0FDB233029DD245622627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dfec381e8a4436c8a25739773d727c9bc1114d7ff2b0d77eed7d34010156bc34
MD5 3d1d69a5156e3a8c34eeb7a1c21075d5
SHA1 61451fb9c23254f04819aa11a87236cb58159f35
SHA512 1a3432223f0f225901e7d718dcf4e14248a06e43538b57cc56ac31c4f381ccc1f95f7bb37f57da166fc72bbe2794813f2340bdb3be1bd03731970f77666d0de3
TLSH
T138E022AAC835AC2708FE471850644A8AF760175B2FA1990F3A3D910CCFB0A2A41C6CBD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 73KB
SHA256 f3d2fda12260ccf193da50e70fe5efb8b89d3c5d4e246eaa053f2cbf4fb07ca4
MD5 345c1023e3d262fb90bd367013335e0f
SHA1 30fd5c4da80ace38caa4fc0da1c950b6ea210787
SHA512 9ae18642326e9e10579bf7b137e14cf5da51953fd2884db14dc6050c4734ec9ad58f7afa35e1d9ee2d0672827845fba2a076bf25069ad40a31de93179c76c842
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQalSYnUxMv:cjW1b1U09DGyQPKzSUFVXCQalSYntv
TLSH
T1D87312C66BCE83A9791BCF3D0D254488AB74C4F0329AEFC3957AA08D7515134B1C63A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 658KB
SHA256 75c25943fdf90c885730d7c25fed5da44026c5f57aa347a0d32fd5df522c2e0d
MD5 7853dd2232a5058d37a8fc104c108801
SHA1 d6ec26d960fb1012da5ab2115c47293241f44330
SHA512 66c1a52584c870204129f6446ef887e76d303c96447d077c80cc4d7382b378a12c8b120ef8e032eb071799dda6221463130397d3520e6610e053beb86df0730b
SSDEEP 12288:C9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hb:uZ1xuVVjfFoynPaVBUR8f+kN10EBJ
TLSH
T19FE48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 f52a12c9c57a617d814bd9a81db081650a39ebabb0d1546cb2216fef791e0247
MD5 2da48d7053e3de063f229a423030588c
SHA1 71d4f3ac76e8914dec49a3b2d2aff8d345084647
SHA512 6bb105892a84ff4477bca49bc1d44017e31c4c7b0b825c061dbb92830cec85f31689b8218da3753342b26687a668d0e81b45552341abae64b59c3f3c1821ccd4
TLSH
T137F0ED8A92D5F04CEF74C1B0F091BD5E642036990A3B1B93CBC0E5E09C83BC15384185
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f06dd8074b353354b5d51d2c49ba33e207119c19eb5b43e5fc34dc5ccbe38e2e
MD5 6ea6274d947e0f0c23047c6b32334bbb
SHA1 74d1117d91d7daa20f18ca8f8ec021ff3fbf4d0f
SHA512 e796befa58212e2b9570ae2b58148063d621bd4dd329f36e508e168130c2b78833deee602897d1c8911b47a1eb6b5b37c4a0d2414c64fda3b17f9fe2f3917848
SSDEEP 192:D/EYjhJaJAIFuaaIEd7Jv2M2/MWm0YMVrOsQUaX6eWbwcd:D/EYjPyAIFuaaIEd7Jv2M2/MWm0YMVrt
TLSH
T1A3F1BDF7C3F8826D881292F4AA252E1FDE5D0A06432C3D5BC4E4AF4B93F64B1E15094E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e86a75100dcaeecef5687cec2fe98097df25cf04fb734b238ed910deb6a6e143
MD5 2e405f1fddeecf7ad1bcc4bd940ce2c2
SHA1 3d19f1e150865c689e7d8e2ba95731f5da687dc6
SHA512 fa72bae479112a42179be51cb9f1c0d3cc36ebfd09dd59bffd3c772c72cb438a14f7830bf9c1712b9530452678a5e78014bcf68de9c4ad4a9c07a108ff5bd557
SSDEEP 192:D/EYjhJaJAIFuaaIEdlv2M2/MWm0YMVrOsQUaX6eWbwckdK:D/EYjPyAIFuaaIEdlv2M2/MWm0YMVrOE
TLSH
T1BAF19DF7C3F8866D881292F4AA252E1FDE5D0A16432C3D5BC4D4AF4B93F64B1E25094E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 198211515893bb6bad90b95836174725277924795644333c08b63d80206490e3
MD5 594eb4669e9213381b4e1e081d89d053
SHA1 d70b66f6d4c2ad5c90c32c0fd3f5cd17f6ac29c1
SHA512 f3ae93dedbdced0d8013bea76f57bb7972b4cbc4bd6601c66ccb9d9ed533db3d31ceaf8e21b4990c55715d793f8f603d2f16d88e6adc6c76a80800e3934edd60
SSDEEP 192:D/EYjhJaJAIFmxIaaIEdlv2M2/MWm0YMVrOsQUaX6eWbwcRaK:D/EYjPyAIFmxIaaIEdlv2M2/MWm0YMVT
TLSH
T1CAF1ACF7C3F8826D881292F4AA256E1FDE1D0A15432C3D5BC4E4AF4B93F64B1E25094E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 81b9687c0f0bc1559b46160f7f75def4d8b0470da47afc9ff716a0ed1285b7f9
MD5 b8a9ab24564f4a62e2f3cdc026d41eb7
SHA1 690c93262a2218c37464b8855b51a6a80cbd3025
SHA512 4632222e5eb769bd87f447978ec24c4a9daba65ea6142d2db4702da5d209e4c86a8fcd8047e15f7ed96408659780d63b0de02ba28ae74de9b114a477ebf3dc46
SSDEEP 192:KRUZreW8NHxv7spAPRp22Flu9wHsb+WNnXUoevD2xXeMAUvVyIsnAUge:KRUZxWhYUX/mKwXbe2PXe
TLSH
T11A42D72EFD64697B5CCBD21AF9627B67E7F6112121901E80E6FC892C05D7ACC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d32e0da2d7d5d7464fc98c0ef072050ff8c798ca3595371ac34b3d7b6ef29a42
MD5 10d048b5640cb23d7c93823c4468ebc9
SHA1 77414989111aded1c214dde7972e3aaa518c4347
SHA512 6f1d85572d18bd5893d44af0d69ec4c3d94cd078e5834d7a3a43932b9a73f7a45f3ee6a704745e74b9fa78b376e689628c33642d8760694d36961a89365f1811
SSDEEP 192:KRrZreW8NHxv7spAPRp22Flu9wHsb+WNnXUoevD2xXeMAUvVyIsnAUge:KRrZxWhYUX/mKwXbe2PXe
TLSH
T14E42D72EFD64697B5CCBD21AF9627B67E7F6112121901E80E6FC892C05D7ACC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 290d2b481128ee7bb000f65bc4d8dba928f70e3ae36e9783155b24b074dac8f2
MD5 d1901dd2c7855d2a84d42d7ace6ea097
SHA1 be5e174b64b2ad4d6d8153bec000b435a64bb2b7
SHA512 09bd8789d128547008a1d5fc1d005b15a95d11ff056831870467ba729bcef90d53abcadd8b4dc7c5f390cd9676a8935057741e3111a66bc8487d6a059d80817f
TLSH
T13EB0126080016511C02606F42283B48CB1149F109E0F170243F4AB228C255908518052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 dfbd10d6a7f7ad76698ae9fbbde59ab2c96a3b2998b2f9d8f15cf25668bbb5b5
MD5 60324ef75add0f831cbedf4a69c6398a
SHA1 0838086b09735d75188935026e9e6388a0656ecb
SHA512 aa4885dfed4747d73dbe7883f0a68c6e00509d8639454e916d36cfb2e67a2bdbf6452f7ed0cfa68f9a81a32ae969f8a0f840c20b2848997a08e8e04440a2335b
TLSH
T156B00265C102B212C05303B03ED9A5EC7A60DF25EA13122692E0AAAAEE2566057296B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 39385a08e3c537a43031f94db67faa0db15adfbd07ce11a54341ca48dddba732
MD5 519752e156afbc344711b261b05d9ae5
SHA1 6c5d10dbaeb01748d9f220c705be538488cbc14f
SHA512 b5b0fec6d2737e953cd3a83c2b8c7e6249e5ef05d6f8de5681dbf022d6870aabc4d68be6593c24b3bd357a3b48c2ca87d8c9a0b4ed64cd1441d383e75239a46c
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:3m7Rkm1tYpBeh2BAoK
TLSH
T11FC3123B5D75F87759B5BB1EB08E1A1F1EF249A6C920DE52C8D85B0823EA7CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 462c3dcda6877e7467da04900ac981d88270bcccc4ad0c72e4e2129fa9b05432
MD5 5fc55cc7bf7cd17781b8584a40aa89f4
SHA1 70b42302c468095e95b79ee6282da5478feec5ee
SHA512 791b9625eef3294c62daf05473506f4499101840b4cb41b6825f1baa99ef6110997908c66f0dbf2f3aecf31bfd60a7831381f19c1cda7e325c8230b484170c6a
SSDEEP 3072:ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Ym7Rkm1tYpBeh2BAoK
TLSH
T1E2C3123B5D75E8779979B70EB08E0B1F1EF249A2D920DE92C8D85A0437E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6e636069747b6c7779242d4010f703e2e5a7fb29aa171839997b944ebced193e
MD5 a1aacc0b7af15ed5ced85330dfa55862
SHA1 02f0819891d5c1fff2d0b0a183e51d7a2528846d
SHA512 7a80476254a93e5e3abb9fdd438a82ea27f65cda993dc9e6d4d021b834c69d967326a290fb44f1a2cae4b387be2a4bc455da0816c45953ec44bc5c0bbd0e6efc
SSDEEP 3072:JGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:om7Rkm1tYpBeh2BAoK
TLSH
T111C3123B5D75F87759B5BB5EB08E0A1F1EF249A6C920DE52C8D85B0823E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c4aa712beaa164f723ac06e99288724bb4c28888230dfa8784e3a4221f165b70
MD5 742eb13fddc6806236afddc518ddc498
SHA1 2895e6ff9c97f9e709fe3b87364f738bef34a723
SHA512 1eae6d736c6155d0d9e28758867280162a50a4b10c34227f36f3583f9cfe97e78687e22f9a88dc2e80def0daae3389b10895339559ce34fc7bf1ba17b4699f24
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:1m7Rkm1tYpBeh2BAoK
TLSH
T16FC3123B5D75F87759B5BB5EB08E0A1F1EF249A6C920DE52C8D85B0823E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7f4771e65c2fb3dff126e2c6dff0188229e86201c251facd9cc90a8954d9a8f7
MD5 63e30092e617b552fe27f8acd324b823
SHA1 167196cd3f02b68444fdc7a3f2a1eeefdf038ac1
SHA512 3bb469cd9818a71ab43339ba23524484d8e9650e211f248d50eceb9dd5f432c7cd9cf5f556a54a88c48c966287a9529f079486a86766b240d7bf1460fa47ca32
SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:2m7Rkm1tYpBeh2BAoK
TLSH
T1FFC3123B5D75A83799B5BB0EB08E0B1F1EF249A7C930DE46C8D85A0833E96CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e823bba55b0d979eb53fcbb446efe7054befdf45ae115136f3ace54e61f5dc87
MD5 830f76cb1b7fd9f11508e45c9c967843
SHA1 c0ca544480f8ada1740f9481c31756a8a7f913be
SHA512 b766e34dce90849a306f8c588775b29125761fe1d0b520d1100d70e59447d95e671a6d1b24a3d80ca61e87f9a15071859e71ef0456bbda23ad3637f95e7bfca5
TLSH
T1E4D080237B1D7182F35B4175D463D7026A1680756463B701B325D41C9A740C9F2CB1C2
MD5 SHA1 SHA512 TLSH

Submit Download

0b39cb3c-4c30-43fe-ad7c-3cb75e2df029.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b39cb3c-4c30-43fe-ad7c-3cb75e2df029.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2901d5ef31318d69e4edcf9cf6b556d9b9d89cac5bc1c52b377b4de2fb07c154
MD5 10d0f8665f0941b4eb5fe8599e241a1f
SHA1 9a563c7e9c0e718048a1d105d3b5ae0e1ec8076d
SHA512 6ce53d899ccd162ef88637c85e14d9ef9004de8d6eda48cfef0360fba5db65cb0c9402c438921ab469b1bfcfad854f98cdf2022caf4db32f1eb5a8013f9da83c
TLSH
T11B81A63E110248B7D7911237C0F333867AB3AAEBF9236E561374797BA525395B88512C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 5d951925aff1626b93056ddf90f3489a54a888cba8fed4625973e5e397d68bba
MD5 09957d4a4cebbb13dc0edffb3fadde24
SHA1 4a2fb226181bdcf67fdc572257f755cba6a53bbb
SHA512 5e5bc1d490e6018eef675ffe8c095a635e35e7ea04f4230fc4c1f4b2dd3d704d9099d1acc9d4992334c463a981cc2e49ebf437884d526619fea5e1fadcc46f4d
TLSH
T153E0D8B5B9CBC11E967035C282385F0892C43A82D6C9AE0327408CD47A42042F651996
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 c5d95b72cc29c042e5ca9468b24283d27ee542a290c184c63e45bfd85f65b996
MD5 c753d607ba8f5f437fdf99a9d91dc388
SHA1 e5edaadd785d26b7ecc6783c3111d4a69bff44d0
SHA512 470c59f839682ede414016c932a3cd0d063d19407b13adb6ff883e451630b0a15b3fcdf157a229ff3254daf8f058e5c0c1a8cde670aea92ec638c38e963df371
TLSH
T1DCE0262415C8C16AD0647BD3837D5B0997D03E82A3CC3B02278C8C84B101643E6E6AC4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 95f38995b167b262fcc161daf8c21bcd710fd71d75fe3cbb70ec798bf425faf2
MD5 459921d93e6be4f2416f6debd7a69f4d
SHA1 f9bea10f0c13d2041528b727e378f8af2eac3099
SHA512 cf3d7a89f9d5535bd07074e5138926a241c962c17556b118f6acb0e5b31e9133257cb02b8d12c8fb5674e33ff1ca65d8bd25053d8ac7e8596c7217607ad7ffd7
TLSH
T1D3E026240AECC169D0A46DD382795B4DD7D03A82B2CC3A422B8898887201641F7CAE81
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 4e219782138668c505ae598be12a0f738ebf01686658391592f4c4aeccc84dcf
MD5 295e7e3d7c4498e9f7aed8c5c743d834
SHA1 127f252f9642ed74be2705c74093ad264ad2da37
SHA512 4c0cac17aac5c45f10c5d722d18c3a84c350ddbd8b1eff1ad562d1a01f5a2ac5c69682b3852cd87f7b9c6e9463424aff520d0f3af95734dbb3d99f50b5bc79dc
TLSH
T104E0DF7056DEC12AA254218B93296B09EFB03A46E6CC6B022B849CC4F801004EAA26D2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b8ea2c4fc39d87a2ef95f380c904081995c2ac669784cabe7ba62eb9b24a7395
MD5 89a1860571ae1ff0cd8714cc92db2699
SHA1 161a003d48d30d1ee1636d578c282eb41e6b9901
SHA512 75f5756fb0855c51b2481c0f9cf9209964c6d2063ba47661b740fb257e6bc6b921504b348d41352905601f7fba7b8033afedf834af4baaddb6f7edfbce96b54f
SSDEEP 96:sa2viEDWt90sc0tb9NDEedHWU6W6hfuH9EOx+WVoMfm+uecpYQjxMV6746MwUhgF:sxvut+sblDEA5HW6+WNGYX6MxhgF
TLSH
T168E1B7526F38687B4CC7E11DBA267B53E2F6503265C5194CEAFC8A5C099B6CD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ac0d8035201a9f269ff9af516e4ddf250c43780e31543e38b936ef1b989e7e7e
MD5 f26d41b8a43ce8e3ad7f1c32b1d1dd76
SHA1 0493aeb729985040f0157e683a1b84984b53fae9
SHA512 a7e502a819695f73536e7e0e408e1b964c0110f87080192455522d0e35115772fbb53aa6d91132e55891ccd81acaf62f542440042a6f0691ca4e1656ea7d9fca
SSDEEP 96:sa2jBiEDWt90sc0tbDNDEYdHWU6W6hfuH9EOx+WVoMfm+uecpYQjxMV6746NwUho:sx1ut+sbPDEu5HW6+WNGYX6NxhgF
TLSH
T1A4F1C7566E24697B4CCBD11DFA267B53E2F6503275C51A4CAAFC8A5C08D76CD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 560668054ecd403dac545fa018d5af000831ecf4b5ae774468cea6af70426b7d
MD5 054615d65015dfc8f270794ef5a72c2a
SHA1 4cbcc4cf985c83fe5f557f1f44154fd01bbdecfb
SHA512 4e92f28edc9ca2ae1010260122c2a31a19c12dd46d2e21cb3f04ff99dfd033f26e528295c93dade13cc889c33802f88ef7d1de291003b9a5997e7fab1c7d5477
SSDEEP 96:sa2YBiEDWt90sc0tbDNDEYdHWU6W6hfuH9EOx+WVoMfm+uecpYQjxMV6Y46LwUh7:sxUut+sbPDEu5HW6+WNGYg6LxhgOJ
TLSH
T12AF1B6566E24697B4CCBD21DFA267B53E2F6113275C51A4CEAFC991C049B6CD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 e409891a501a7ef2b9269d290cb3758bdda5156623c2e768b13085d8e50c1dc0
MD5 93987ba8f7ef917baa2dda251fe954d0
SHA1 79d89a17ea06569764b24308f7e896da54ae5a4c
SHA512 610a0dedd3577f60d4cc799f8249fb9389e1cd03e0b616d3019801b88ef2089787fefe9cd312e49a6fed8a248216be5355a294c9907fd7ddf1b4774f9ab0260e
SSDEEP 768:FkyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR/WrogIfO:FkyqbblWvJDjTu1jah4LAs/tgIG
TLSH
T18AC2F93B654CCA7E4F800A9DDD5A6FD73E9802C7A6588D4047FA994C02CB7EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 2d7fb073fb7567aa708aa2e374075353413582b0bfe22f6390ea33acf0196214
MD5 a5530c5853dda5da8b3310b8f332a960
SHA1 0f73fd0778ec367aef6515b27a3821356aee2030
SHA512 55fe46d64ab0fe1ce51bdff16ca36b7a2045746570fa26ac71935f9f4977288ce2f50cb04a62843064bb8b1fd0862c204ee5b1277c0d433c57c7f3371441507b
TLSH
T1DCE026244BCCC17DE056224706258B08A3E97E67D3CC3E86BFC8DC847782784F292592
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 e51358dc2df935de3ea83e643fe38e95b94cdf048d601df0907aee9a20b1a24f
MD5 bdaa97687ce057fbcacd5451657862e1
SHA1 6c1e67424fe204b5ddb8441d5cc6521aa6d6c60b
SHA512 fcf66eb79a917f0b63d34cb399bf30d64176593e84e6148ca6ccb543f5a7a66f9f94c90b58ed0a25e29d053ddb4b9ef002aef8678044eec6f5bcc476c5f3d642
TLSH
T1C2E0262426C8C97EF265324703258708FBE87A47E2EC3E023FC0CCC4A542905F9E69C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 bbbbd6d414c8931f2ced53d155e527515a1f946aef8a8c4fe27c35e0765f21d6
MD5 01daa2bc4952310244c327a06a3a14af
SHA1 f91e3373e12e85c640d6efeba30e342ba3874b97
SHA512 3e9d1fbc03ad8cc005b1acaf605129c3bc11fa0859800746a65cb8df9ff369892c7b757d81f3d69611eee4d8d74931746b8b7f520834f6d35558807c45d58d1a
TLSH
T117E0D87057DDC72AB1892187422AD70892E37E73D7CC6A517B58B8847246240F243581
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 344B
SHA256 3f17c64ff20c7c224d65c25ccb75dc76b1dc56453f9ab3dc3b58644d74687a4c
MD5 ae9795e44f3df39b4267ebadefe32bb5
SHA1 953e2589a8ef643b8f1728d6d6036b74d976974e
SHA512 f7dbdd4c106ed5e95843d3a545d8dac78f28df9cbb4054955745d560b9a9cb6b30d4e4355ac03d3aa47584298c204a790a7bca9f81ccb157281118c7f50111b9
TLSH
T156E0D83027C9C62BA1D6318F4314EB0893A27A46E6CD6B123B4C98C86346580F293580
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 194B
SHA256 f9a497be96dcab58091e4d5d2389fea3cf4fbde7f8e2e4abac7010cb35ca84ef
MD5 b3b74961bff7ab9fc0f4f3a57f637184
SHA1 1f77ba6e313bc4c498df1c7c4157d79e3df685bd
SHA512 7cedf227788ff68e18579e70187c3dff712652063f322be6eba969f768f719ae9ee7b52c721ce92b7717c29c7e58e480a8739cf862cef123b87ff0b11ebf3c2c
TLSH
T14AC04CD55A903023FDCA59390DAB53041B20C4752F74CE57D28430901C0A285FE61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 9ef1e12ebe65f1596b8e76c8f34bb7c6461832b80ba17b54273ccad2f4a064d1
MD5 819255ba5535ea6763404f6cbc1e0eb1
SHA1 eea5bf1f54d2044b44eaf10c325d713159245432
SHA512 1c6a842971ec53b0a88e1bad428242f739523452efd3586eabcf0b8a616d8197f6b35c4386a0061309bccf5542e8146a16875a6faef07b9f7014d6adb6f3084c
TLSH
T17DE026704BCCC679944865D74274AB1ED2F07E5693CC3BC26798548CB541210F6EAD81
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 7e895dd2c6ee23187a12b73f820f21ca6aa342b4867306727d88c227abdd5cf4
MD5 dc11edd2c5bae657a9d218353bfc5977
SHA1 73121853a68b50c820f039cf8f91511673bd1a90
SHA512 01fd9d69ff268bce7ba42365298ad30d45194072c209783625b0918a4d1b3175442cba300d3ab2906e589457b8f3a87684981637cd1c257f5f9b24e3a28bb46e
TLSH
T137E0DFF45ACCC63A9050B28343749B0ED3A07F8693CC3A82775C8C84A601509B6B69C0
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d459c3c440bb2e374dac10cb638a5395ccba7207153106fec5c7eb823d6531f6
MD5 d454f11a4cdab31c042e598d8169a7b0
SHA1 3d9e1b1291bd887f6394377f13ddf01e2cf96a1d
SHA512 1e0795a5f3a84b2e19f2f87cb7767627fdb57f8665530971b5c9bae8380277bd840051861d21cf123b13130ee953b2ba1d82089dea81641162cdc6b5199463b8
SSDEEP 192:UHsNI36JkRboPdQmiUy2B2XUnVRNDXOmj+P+9TFvSVRLwqNXUO:qsNi6UbOsGVRNDXOI+W9ZvkTUO
TLSH
T14612F735A8389C778EE6A515F58B36939EA82077AD856F90E1D80E0C01D769C374BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 27076375dd2c3c8bbd01c71f2066700c5879ddf0d1d35177c556a4b61ffef209
MD5 65fd7f9d3df72a2dd1172a45a59084fa
SHA1 d88fbc7ef41ccdff3dec95872eeb0b9fc8f988ba
SHA512 ab64bf313077524b63c180ccd10c4a2b5ba112006da62361b46ad52d8787250e1013cad602be47d5d7fb89aa8dfa5536a4f73938455bd32af355c094e380a8c4
SSDEEP 192:tONR6JkRtQmiUy2x2XW+RNDXOmj+Oh3LEiRiU6:tONR6UrMW+RNDXOI+mUU6
TLSH
T14102D9356D382C7B9EF26E06B58B37175FA8207BBA856F80D6D81F1C01D769C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 56a4a9128523f7b18e3fcc5c645520431ffbb38e9af6879d9b71a668bde87b0c
MD5 f79efebcf88cee99233ef6286516b048
SHA1 946e5c458399e4ae3c827dd7b7e708e69e7b65a8
SHA512 01e105b28566b89caeba3fd43cfd28c8b478b8df91ba1cbacce30a396d2aacc167db3575899778ab23987a5e66173551ffcd6f56663185c7a0361ab8cec0668f
SSDEEP 192:z8HsNm6JkRboPdQmiUy2R2YUnVRNDXOmj+P+9TFvSoAxqznUO:zisNm6UbOrGVRNDXOI+W9Zv2CUO
TLSH
T19F12F935A9382C778EF2AE56F58B36135FA8217BE9852E90D5D81E0C01D7A9C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c372bf48b3a765f79a61d847c26b8cdb7d11d28691a86a58681dc77cf1158c29
MD5 022473f9489cf82c0d42e84387d659f0
SHA1 850d20c1eebfa5af31d3a54ecd5e056b5630644d
SHA512 21fb8ccd807f05bfca72d4a03e89ab354d82cdb1f7833e59059a3903d44e108135ed2a81ad1fb7c1fb03a794ee4a2a0cf3650eb6bc0952573f98a876095d8451
SSDEEP 192:UHsNI36JkRboPdQmiUy2E2XUnVRNDXOmj+P+9TFvSVRLwqNXUO:qsNi6UbOdGVRNDXOI+W9ZvkTUO
TLSH
T1E512F735A8389C778EE6A515F58B36939EA82077AD856F90E1D80E0C01D7A9C374BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b78359b240a3aba1f05d478da52b4872634622e6b5b1dbc21271c800580d897b
MD5 c65d33cbdc3a8681fadf11a094f49989
SHA1 28142b3fba300604bb534786d1341de27d472aa6
SHA512 c2e96639015738be8b3bb9bf436918a395fc7806bfac9a128f41d7dd08dee2b929257f27df504e79df850799dc1f5487bc3955ece5f7eeb8ec51e064b2008eb7
SSDEEP 192:UHsNm6JkRboPdQmiUy2R2XUnVRNDXOmj+P+9TFvSoAnqznUO:qsNm6UbOkGVRNDXOI+W9Zv2wUO
TLSH
T19112F835AD382C778EF2AE55F58B36179FA8213BE9852E90D5D81E0C01D7A9C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a55c57f8b11820db5edea3d0f44fa2e10486364b6cb0f89ef19c29238e78506
MD5 30cd97f9f051cd3fbdc22781636ea192
SHA1 56c4ee7b0f0a6e385c5e88a507d006c83fff8a1b
SHA512 0a13d73812eb6f55bfc848f02c99e1aefc4b8fdad8009f831828aa2ab984258db6352cc70b3dba6024e775e9c13da80dac09464ff3df13be0537c42c4792546b
SSDEEP 192:UHONI26JkRBdQmiUy2l2XUn+RNDXOmj+P+9TFvSVcLEdqNXU6:qONB6UtQG+RNDXOI+W9Zv17U6
TLSH
T1BE121931B8399C375EE6A505F58B36939EA8207BED856F90D1D90F0C01DBA9C374BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 87d24a4c517ca493dd58d3e1eeba140f5884c26c477504894f747f75a52dbe2c
MD5 f32fea9f3ce1729959ee841404a107d9
SHA1 b1e9c96bf7c0040c9fcbef9ea2e957b36447ad8e
SHA512 39bd64e546ee5486cd21381f6f74b60533747510b48c879675f11ea678f72d02f8e76e9de019e40fbf1fdcd00773ce3dc6ddf26e1f917ad6c1d2a58d1c0da9bc
SSDEEP 192:z8HsN+6JkRboPdQmiUy2o2YUnVRNDXOmj+P+9TFvSL/1qzGVUO:zisN+6UbOGGVRNDXOI+W9Zv4HVUO
TLSH
T1C8120935AD382C778EF2AE56F58B36179FA8217BE5852E90D5D80E0C01D7A9C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6dc3166c390d2404a97491065ae6ff90779e0edc7180983ca47a9da8d5c44529
MD5 a90491dd23544cd1b54de8c59b6861fe
SHA1 2fffdfff4d02d42a46f3c3340659b1d9afc8b413
SHA512 5a4075599faa5b69c7c237a8add999f4b13e045860825d1fd6275c5511f2d9e88ac90d825ab2875ba714eb3ad41a88ba95fc4096dd0dc0f65a87461152a05500
SSDEEP 192:z8HsN+VJkRboPdQmiUy2o2YUnVRNDXOmj+P+9TFvSL/RqzGVUO:zisN+VUbOGGVRNDXOI+W9Zv4zVUO
TLSH
T1DF120935AD386C778EF2AE16F58B36179FA8213BA5852E90D5D90E0C01D7A9C2347C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0e3k0s1f.1fr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0e3k0s1f.1fr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_f59eb527-8bcb-4e9a-81c2-637f249ee281\DiagPackage.dll
Size 65KB
SHA256 9d6e3ed51893661dfe5a98557f5e7e255bbe223e3403a42aa44ea563098c947e
MD5 79134a74dd0f019af67d9498192f5652
SHA1 90235b521e92e600d189d75f7f733c4bda02c027
SHA512 1627d3abe3a54478c131f664f43c8e91dc5d2f2f7ddc049bc30dfa065eee329ed93edd73c9b93cf07bed997f43d58842333b3678e61aceac391fbe171d8461a3
SSDEEP 1536:XgLADXf3iFGQ+/ReBQBJJgUKZgyxMBGb:XgcDXvKoRqKuxgyx
TLSH
T142536BD692C48EB0E22842B0C82BCDA15A22BD36CD15372B57E9F52F287234665DF31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_f59eb527-8bcb-4e9a-81c2-637f249ee281\en-US\DiagPackage.dll.mui
Size 10KB
SHA256 51d06affd4db0e4b37d35d0e85b8209d5fab741904e8d03df1a27a0be102324f
MD5 d7309f9b759ccb83b676420b4bde0182
SHA1 641ad24a420e2774a75168aaf1e990fca240e348
SHA512 7284f2d48e1747bbc97a1dab91fb57ff659ed9a05b3fa78a7def733e809c15834c15912102f03a81019261431e9ed3c110fd96539c9628c55653e7ac21d8478d
SSDEEP 96:Prsd6gDV8m7t/C7eGu7tCuKFtrHQcoC1dIO4Pktmg5Cuxh+FEWguv0Ww1:jsUovu548tmirRW98WC
TLSH
T1FA22660163FE1619F2FB3F70A9B61A644A3FFC56AE39E35D0205419D69B1B508E60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-627-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1252-262-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1516-613-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2036-619-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2284-615-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2384-248-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2384-192-0x00000000023A0000-0x00000000023A1000-memory.dmp

Download

memory/2384-359-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2384-193-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2384-253-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2384-163-0x000000000049D000-0x000000000049F000-memory.dmp

Download

memory/2384-375-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2384-162-0x00000000023A0000-0x00000000023A1000-memory.dmp

Download

memory/2384-360-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2496-796-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2508-189-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2572-827-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2612-628-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/2868-203-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3168-191-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3484-842-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3628-604-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3680-205-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3800-616-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4044-626-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4144-621-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4164-250-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4388-828-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5060-186-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5060-187-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5084-623-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5168-617-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5268-618-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5364-624-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5412-216-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5456-218-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5468-256-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5500-220-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5508-795-0x0000020B71000000-0x0000020B71008000-memory.dmp

Download

memory/5508-771-0x0000020B70D60000-0x0000020B70D82000-memory.dmp

Download

memory/5508-787-0x0000020B70DA0000-0x0000020B70DA8000-memory.dmp

Download

memory/5508-779-0x0000020B70D90000-0x0000020B70D98000-memory.dmp

Download

memory/5548-798-0x00000166E6A00000-0x00000166E6BAE000-memory.dmp

Download

memory/5548-825-0x00000166E6A00000-0x00000166E6BAE000-memory.dmp

Download

memory/5592-826-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5800-225-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5844-630-0x0000000000400000-0x00000000004B2000-memory.dmp

Download