ff3767d58402f3e03c1a604195075247acb1bcc3ee14ee7d1f98fad060c6f28e

Analysis

user interaction
yes
max time kernel
319s
max time network
321s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Primordial Client Launcher-1.0.4-win64.exe
Size 2.5MB
Sample260815-s2an8szthy
SHA256 ff3767d58402f3e03c1a604195075247acb1bcc3ee14ee7d1f98fad060c6f28e
MD5 685fb3ee7301fd7c797eff43074b7384
SHA1 8acfba7ae5ef229accdef2be30a9232e775e31de
SHA512 51c077cfae2625552780ea88eb2fe1511409778eb08f72892d2ceddf951cca0c81650da24b9eaaf40ea30a1853d2a08091fda06927e982a1fbac5c31d87e2bbd
SSDEEP 49152:IQJL0PabC7G0mg+oKYWnZXUaWwqT67DE1Wg2tBvEfx7wp7XH+:IKQyb8mg3AXUahqT60wgShOx7GX+
TLSH
T116C5334173A0883AFA350475EAD9DFD76273B171388DD45BBF008A8AAEB5C40DD792B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4284	PrimordialClientLauncher.exe
1756	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe
3640	Uninstall.exe
1008	PrimordialClientLauncher.exe

Loads dropped DLL 10 IoCs

pid	Process
4608	Primordial Client Launcher-1.0.4-win64.exe
4608	Primordial Client Launcher-1.0.4-win64.exe
4608	Primordial Client Launcher-1.0.4-win64.exe
4608	Primordial Client Launcher-1.0.4-win64.exe
4608	Primordial Client Launcher-1.0.4-win64.exe
4608	Primordial Client Launcher-1.0.4-win64.exe
3640	Uninstall.exe
3640	Uninstall.exe
1756	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe
1756	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
173	discord.com
1	discord.com
11	discord.com
12	discord.com
56	discord.com
64	discord.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Primordial Client Launcher\Uninstall.exe	Uninstall.exe
File opened for modification	C:\Program Files\Primordial Client Launcher\	Uninstall.exe
File created	C:\Program Files\Primordial Client Launcher\PrimordialClientLauncher.exe	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe
File opened for modification	C:\Program Files\Primordial Client Launcher\Uninstall.exe	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe
File created	C:\Program Files\Primordial Client Launcher\PrimordialClientLauncher.exe	Primordial Client Launcher-1.0.4-win64.exe
File created	C:\Program Files\Primordial Client Launcher\Uninstall.exe	Primordial Client Launcher-1.0.4-win64.exe
File opened for modification	C:\Program Files\Primordial Client Launcher\PrimordialClientLauncher.exe	Uninstall.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_619299339\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Primordial Client Launcher-1.0.4-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312819629665149"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{D46A1C3A-C2C6-47FF-BBC3-CE9F5D3CC1A9}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{DCA22457-DBFE-45CD-BE83-19447FF25A95}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
1008	PrimordialClientLauncher.exe
1008	PrimordialClientLauncher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1008	PrimordialClientLauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3324	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4284	PrimordialClientLauncher.exe
1008	PrimordialClientLauncher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4284	4608	Primordial Client Launcher-1.0.4-win64.exe	90
PID 4284 wrote to memory of 1756	4284	PrimordialClientLauncher.exe	92
PID 1756 wrote to memory of 3640	1756	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe	93
PID 1756 wrote to memory of 1008	1756	PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe	94
PID 1008 wrote to memory of 2712	1008	PrimordialClientLauncher.exe	95
PID 2712 wrote to memory of 3324	2712	msedge.exe	96
PID 3324 wrote to memory of 900	3324	msedge.exe	97
PID 3324 wrote to memory of 4848	3324	msedge.exe	98
PID 3324 wrote to memory of 5116	3324	msedge.exe	100
PID 3324 wrote to memory of 4848	3324	msedge.exe	98
PID 3324 wrote to memory of 4848	3324	msedge.exe	98
PID 3324 wrote to memory of 1968	3324	msedge.exe	101
PID 3324 wrote to memory of 1968	3324	msedge.exe	101
PID 3324 wrote to memory of 6008	3324	msedge.exe	102
PID 3324 wrote to memory of 6008	3324	msedge.exe	102
PID 3324 wrote to memory of 6008	3324	msedge.exe	102
PID 3324 wrote to memory of 4912	3324	msedge.exe	103
PID 3324 wrote to memory of 4912	3324	msedge.exe	103
PID 3324 wrote to memory of 4912	3324	msedge.exe	103
PID 3324 wrote to memory of 6072	3324	msedge.exe	104
PID 3324 wrote to memory of 6072	3324	msedge.exe	104
PID 3324 wrote to memory of 6072	3324	msedge.exe	104
PID 3324 wrote to memory of 2672	3324	msedge.exe	105
PID 3324 wrote to memory of 2672	3324	msedge.exe	105
PID 3324 wrote to memory of 2672	3324	msedge.exe	105
PID 3324 wrote to memory of 4868	3324	msedge.exe	106
PID 3324 wrote to memory of 4868	3324	msedge.exe	106
PID 3324 wrote to memory of 5528	3324	msedge.exe	108
PID 3324 wrote to memory of 5528	3324	msedge.exe	108
PID 3324 wrote to memory of 2384	3324	msedge.exe	109
PID 3324 wrote to memory of 2384	3324	msedge.exe	109
PID 3324 wrote to memory of 4708	3324	msedge.exe	111
PID 3324 wrote to memory of 3424	3324	msedge.exe	112
PID 3324 wrote to memory of 5744	3324	msedge.exe	113
PID 3324 wrote to memory of 5964	3324	msedge.exe	114
PID 3324 wrote to memory of 6056	3324	msedge.exe	117
PID 3324 wrote to memory of 1864	3324	msedge.exe	118
PID 3324 wrote to memory of 1864	3324	msedge.exe	118
PID 3324 wrote to memory of 4988	3324	msedge.exe	121
PID 3324 wrote to memory of 4988	3324	msedge.exe	121
PID 3324 wrote to memory of 5712	3324	msedge.exe	122
PID 3324 wrote to memory of 5712	3324	msedge.exe	122
PID 3324 wrote to memory of 352	3324	msedge.exe	124
PID 3324 wrote to memory of 352	3324	msedge.exe	124
PID 3324 wrote to memory of 352	3324	msedge.exe	124
PID 3324 wrote to memory of 4744	3324	msedge.exe	127
PID 3324 wrote to memory of 4744	3324	msedge.exe	127
PID 3324 wrote to memory of 5472	3324	msedge.exe	129
PID 3324 wrote to memory of 5472	3324	msedge.exe	129
PID 3324 wrote to memory of 5472	3324	msedge.exe	129
PID 3324 wrote to memory of 2908	3324	msedge.exe	130
PID 3324 wrote to memory of 3484	3324	msedge.exe	131
PID 3324 wrote to memory of 3484	3324	msedge.exe	131
PID 3324 wrote to memory of 1804	3324	msedge.exe	132
PID 3324 wrote to memory of 1804	3324	msedge.exe	132
PID 3324 wrote to memory of 1804	3324	msedge.exe	132
PID 3324 wrote to memory of 3860	3324	msedge.exe	133
PID 3324 wrote to memory of 3860	3324	msedge.exe	133
PID 3324 wrote to memory of 3860	3324	msedge.exe	133
PID 3324 wrote to memory of 612	3324	msedge.exe	134
PID 1008 wrote to memory of 3248	1008	PrimordialClientLauncher.exe	135
PID 3248 wrote to memory of 5580	3248	msedge.exe	136
PID 3324 wrote to memory of 612	3324	msedge.exe	134
PID 3324 wrote to memory of 612	3324	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\Primordial Client Launcher-1.0.4-win64.exe
"C:\Users\Admin\AppData\Local\Temp\Primordial Client Launcher-1.0.4-win64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files\Primordial Client Launcher\PrimordialClientLauncher.exe
  "C:\Program Files\Primordial Client Launcher\.\PrimordialClientLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe
    "C:\Users\Admin\AppData\Local\Temp\PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Program Files\Primordial Client Launcher\Uninstall.exe
      "C:\Program Files\Primordial Client Launcher\Uninstall.exe" /S _?=C:\Program Files\Primordial Client Launcher
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:3640
  - - C:\Program Files\Primordial Client Launcher\PrimordialClientLauncher.exe
      "C:\Program Files\Primordial Client Launcher\.\PrimordialClientLauncher.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1508758140517093459&redirect_uri=http%3A%2F%2Flocalhost%3A38471%2Fcallback&response_type=code&scope=identify%20guilds.join&state=8e070f9ab3aed431de12fbf1d4861077&code_challenge=UqyuOTjcvSJ_mbGi4xgaxwlVNGoG9txFAJ4rHh5bAjk&code_challenge_method=S256
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1508758140517093459&redirect_uri=http%3A%2F%2Flocalhost%3A38471%2Fcallback&response_type=code&scope=identify%20guilds.join&state=8e070f9ab3aed431de12fbf1d4861077&code_challenge=UqyuOTjcvSJ_mbGi4xgaxwlVNGoG9txFAJ4rHh5bAjk&code_challenge_method=S256
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x324,0x7ff920ddc188,0x7ff920ddc194,0x7ff920ddc1a0
        7⤵
        
        PID:900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,10561910341010918865,3749948898975775003,262144 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
        7⤵
        
        PID:4848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,6762083556173878321,6133104970243289628,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,63936949288204052,570131693386765450,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:13
        7⤵
        
        PID:1968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3728,i,12211563253031319264,13358348405332690889,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
        7⤵
        
        PID:6008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3724,i,2984926196879203968,2964864861416334103,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
        7⤵
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,3946185447078011399,4306136256494820147,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
        7⤵
        
        PID:6072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,902325231220934546,17315020938993850181,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
        7⤵
        
        PID:2672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,3869918694058508041,17959194803333964534,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
        7⤵
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,15770494396305654810,14661685369646188726,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
        7⤵
        
        PID:5528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5668934792935337312,7012764734714035487,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
        7⤵
        
        PID:2384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4580173739538420113,12079131828226343976,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
        7⤵
        
        PID:4424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4580173739538420113,12079131828226343976,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
        7⤵
        
        PID:4708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14742613007547627656,2957462192398359663,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
        7⤵
        
        PID:3424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,10090206264134448991,7711845848829828009,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
        7⤵
        
        PID:5744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,12965650717258682291,16656717319609640305,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
        7⤵
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,12166845475934566047,1889877907570134787,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
        7⤵
        Modifies registry class
        
        PID:6056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7756772805912761530,5912353335506856215,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:12
        7⤵
        
        PID:1864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,13807778756138385466,7640818357969017368,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
        7⤵
        
        PID:4988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,9481748852505274930,12748153186434058831,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
        7⤵
        
        PID:5712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7072,i,17066328200340976910,7288014762338209562,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
        7⤵
        
        PID:352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,6699088894506096415,6953705773864728485,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
        7⤵
        
        PID:4744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2940,i,1891427752790113700,4430435517379098493,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
        7⤵
        
        PID:5472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3496,i,3759255184771845581,10178739963710548224,262144 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:10
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7110402483851722818,5509646254217674352,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=796 /prefetch:14
        7⤵
        
        PID:3484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5204,i,16527532208717960389,14153929354281699627,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
        7⤵
        
        PID:1804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5628,i,15833193656219804706,11201075022543590720,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
        7⤵
        
        PID:3860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5668,i,1171394110113536571,11683654730678791128,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
        7⤵
        
        PID:612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=1820,i,15073834088855969499,608074176923745119,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
        7⤵
        
        PID:3272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5836,i,144551536673050715,16773185173205599120,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
        7⤵
        
        PID:5584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6348,i,5425780571400124937,7480463483462370240,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
        7⤵
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5068,i,4608110481587034218,6537163299138135759,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:1
        7⤵
        
        PID:6136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5668,i,715248669725600760,7628708993320783615,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:1
        7⤵
        
        PID:2480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,11534679662332871503,18275445807005579765,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        7⤵
        
        PID:2084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,14197104652118356378,12165469043885207431,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
        7⤵
        
        PID:1176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,16541459065730699009,8994586618581913971,524288 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
        7⤵
        
        PID:1560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7564,i,14430035129585365771,9832763193723427602,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
        7⤵
        
        PID:3772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7704,i,12149149796440290090,1368537465035668247,2097152 --field-trial-handle=2212,i,5511355409859441581,5113992048083216768,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
        7⤵
        
        PID:5876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1508758140517093459&redirect_uri=http%3A%2F%2Flocalhost%3A38471%2Fcallback&response_type=code&scope=identify%20guilds.join&state=6fe9ee1b708809b5d6c35e666f491c47&code_challenge=sNwtJpMAhe8S_wlUjdVd_OImVJk7tZxmc-Gc24S0WwM&code_challenge_method=S256
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1508758140517093459&redirect_uri=http%3A%2F%2Flocalhost%3A38471%2Fcallback&response_type=code&scope=identify%20guilds.join&state=6fe9ee1b708809b5d6c35e666f491c47&code_challenge=sNwtJpMAhe8S_wlUjdVd_OImVJk7tZxmc-Gc24S0WwM&code_challenge_method=S256
        6⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1508758140517093459&redirect_uri=http%3A%2F%2Flocalhost%3A38471%2Fcallback&response_type=code&scope=identify%20guilds.join&state=425fd9e59f151e0f73cf28fe1a1da565&code_challenge=2P2e8USd_MHVgypLiSpgC0UEKgiHimnPxg96Ypy0ooo&code_challenge_method=S256
        5⤵
        
        PID:260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1508758140517093459&redirect_uri=http%3A%2F%2Flocalhost%3A38471%2Fcallback&response_type=code&scope=identify%20guilds.join&state=425fd9e59f151e0f73cf28fe1a1da565&code_challenge=2P2e8USd_MHVgypLiSpgC0UEKgiHimnPxg96Ypy0ooo&code_challenge_method=S256
        6⤵
        
        PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PrimordialClientLauncher.exe

Path C:\Program Files\Primordial Client Launcher\PrimordialClientLauncher.exe
Size 5.7MB
SHA256 c9f661be318e597854f5d042d0566e192460efd5ff04b50153384ac3b77a34c5
MD5 2a8b2bbc5065fa8658ae87217da7a9b7
SHA1 c5d4f8a824e43380261edff07a38c9d76aa1c3f2
SHA512 be7ea2b38b78ad16f4771709458f43531ec68109de03bc18ce8cb1af8f97a61ffecd30a29f5e854e689acb266971bba8a372ea421b59527311205d80fcdb22d5
SSDEEP 49152:a7ZLNs/9VqvW3iRcjefW5dYExO+EhhtbA5xn0efrg0ukGXK9MonK3PMC05HryFrP:aE/p35jefWzd0C5HrJmqqJNzwRi/MyU
TLSH
T1B756AD7272D150D5E01BE1BA1E437942B1B3388A0770A6C7E784995AAF775A00EFB3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\Primordial Client Launcher\Uninstall.exe
Size 138KB
SHA256 d336546291616f1f06c3c18726584c0c9a74a9a0f1a9757a55cf2528f827414e
MD5 b04a38eea565abf160db21235e8134f9
SHA1 dc4ece6c0871c3bbf7c0673060715849c11cb8d6
SHA512 9e57b1a2839746ce794fd50a5f8ca50721897181735b1ec818823abc7834cc7d54fd1248b421ee42d580b5e593f76c47826ee9151d813234ab72b54106648987
SSDEEP 3072:Pwi0avo8chVAu50xbMu6k/jUOPLX9WrJPzDcO:Pwavo7N0brb/79WrJPf
TLSH
T104D3CF05B3E0C866E8690A308AF6C7E36773F151265D4B8BFB40671BB861E44EE1D3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Primordial Client Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Primordial Client Launcher\Primordial Client Launcher.lnk
Size 791B
SHA256 c11d593797ef8087253fb15f87aa91d9a366bdb82c2533a816a262db3e74942f
MD5 868dcba1de4f222361278aba46ffa1ec
SHA1 021171d4abb9e3decb4d53dab0017bca1ebe6f8c
SHA512 2b8b12a2c5c729d1dd08a553ad98a7cee27b38da0b1bc81a174184d92ca4d2488db681db827e92308b0b1753e34b60fd9c6a98e04cc028a27a80f5eb12cafa31
TLSH
T1EC0149648BEEB7ACF2F7837129354A204AB2FC12BBB5831D1494828E5835A105658F27
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Primordial Client Launcher\Uninstall.lnk
Size 1009B
SHA256 bd832001cae2816197b3e99c9020148ae73a653605427ceeaaee0783bdf5eefd
MD5 457bc5b0955a298067919ac540d8bd24
SHA1 c4e4efb482ee4b07a0cf8dc2dd44bd0b099ca2b9
SHA512 38002ccf60d5ce4a32595f21bea3935568c373b484b7cf1338c3b62f558b080237358c4e7b7a08cb196ff7ffeea6f1475924c3c06731dd4a02485eaf63de3e88
TLSH
T14F11591543AE669DF2F34372383246614BB7FC04BBB8970E59C1D28809B5501AB9CF36
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d6ea29f34581ab3fa43e7053c3678e87f2bd1822fd76dfe50358254adf0f6c43
MD5 308239d76c97c24db9315a5e01710942
SHA1 6dddbb088b1cc541503ab3d3b4aa314de30fdbb0
SHA512 773d0145e1c5dc5797d8457bf5e1dcced5f774cb39be1a27eb969f6e8602e50c0f525a6afb3095fab1aca38f8073b6a5fb8e64719e8b6e457daf6b771b4249a2
TLSH
T19AE0268416CAC26EEA49A68B53A8670C838C3B4BD2CCF94B1B0088887481260AB97691
MD5 SHA1 SHA512 TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 29KB
SHA256 499d0c1c2072af7f5b987695ae6328b6db8ed91d384093f9bcf09180e0cf5e07
MD5 dacfc2b0f94b0942df97dc6c631522eb
SHA1 9ee706b1e0f737b478e31a857a35b658d0208d3f
SHA512 33d006ce2084f4036cba25aa945cc0731b4d6de26264e2d920f11f9c8ccb1078dc6af114baedf09ff9810f90d8c99e5ab7ffb9a37789f89a39098f606606242c
SSDEEP 768:KCVjxk01OX07t+u952O2wHiwqcH08JQns:j4E7aOBHU8Jes
TLSH
T181D2F122ECEA4DB1C2DF925F48819D4688D59CC33A5B34B3D8364EED1272C2CD72552B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 34KB
SHA256 fee43eb318ed267915411065117777079b3ffa5ba8b5322463f0f3324ff33768
MD5 d40c8631c7f38e1cb4a090e9732d535c
SHA1 9923abafb663856491edc798323761d2aec9c9af
SHA512 407b2806ee034487a0fd248f1e48938678668470b8d9bd163defdf21a3738d92ea55c8a76c83f6091eb4cf1ea660e4a0ecb7f58b1e56beccb78e2f735e54521b
SSDEEP 768:5/S0mb+wKhxMa5pPrxC2CUM00DGrSoBWrvv+Ytpgm/nMGk7:5q9aHNC2IbG+uWrWYtpPMGM
TLSH
T17CF2F12DA396988905F17E66A8377DDF24AA8115AF7857FCA38422227F010CC5704F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000048
Size 16KB
SHA256 74fadd91def981c27d0f0f5183d10e5be39094d6b228defb4b72f809fee279b9
MD5 fd35bbf81d411da797d14ca624e1aed4
SHA1 6df197ee4ba6e0cac6c24fec313a4f676cb7b7b2
SHA512 69ebc2c490656ba6c36ad1952e90e5a676e188c7bc9a0e176f14bc57913c64a485ff8f49119371940298ea40aa5029630cd763dbfa3d0fe13ebf42b277674e88
SSDEEP 384:BAhAHAvzMFvLWBHi5cUfhbu1hobuG8tbp/L3ckQJ:BAhAHmMRa1iGEbu1sD8f3cZ
TLSH
T16672CF26173DB18B6633F54C9C2BF906576A4DA3A51902EA43EEFCB53568B4217382B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049
Size 17KB
SHA256 cb42018611a8d8663c657e8bea108e7a4401377cb49f34742c1d6f1e8f6c1542
MD5 68d1d6a73f00f85e983727e8411e8625
SHA1 554c598a0fa57f0d8bdf0d9e9eb6e3db8e60ac75
SHA512 3ec13d87f6066747dfe7cab0be187760e47e42cc3c5374850765488f68cd03b735bc2a0ec97b94772a2ef38315c13f2bad5bc84294e44c640244d0406c19fcc2
SSDEEP 384:YrkEAHLM+lsmD7/wnKrQWqhSy7kZtlrW0nZl2HoBYt:YzSLM+J7uKrpmkZthW0Z+t
TLSH
T1EC82CF5B1D3D9C1BBBF37222A4D2E3A4EDCD5F555BEB9784D1C88100D29C0674093AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 17KB
SHA256 614ddc9955e2d50a93997e90a0a399496c572388af0cf683dfc73aeee977ce50
MD5 159793c145504fb7eb467286ca7bef8f
SHA1 42dafbbaa9b24228ae1b6b30df9b3b083b279023
SHA512 80a722b06afedc065a07099c8232f409f1b7a3a917acf9ef2149c118feaae1b0748cb15c26438cd2263fcfdd5389cc49243be08f76b8cdebf68a734473d67367
SSDEEP 384:lTlnqXk1+bpUP7xccxAUM9A+MEHnFBhhO/pP2:1IXk1+bWjVeUMRdhoR2
TLSH
T14172D0F9C4FAE14BCB7B23161656544F51293684A2003AB86BE7B291DD3093348AA8B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 163KB
SHA256 a3a48e4ad1aecf437b6a300aa216f49eabee287203d0cb12fd8f52538aea37b5
MD5 6fe4bf665155a41186d232a32ad0d8c2
SHA1 7897dab385439a1ff9a7dcf0f8a5048a5b54c207
SHA512 4e56b391d3b824bb3a887625e096e38e0b89640a05219b021865979d92df92ea65e74905616a88c6f8a49bfc26ae8d719ae2c16e1e1893ca943009025537de1d
SSDEEP 3072:L16WkncCoWMkvO3LnSLHbEElv5oDHcMMLAD5dLX5hNVVti6t37s9u:xOn12kvO7SL7EEscoRHfVti6J7t
TLSH
T18FF312CD9A62F5266C2F33362251E3E1960E10EC36FF109C51F1AE75B50A2ED839B166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 269KB
SHA256 4f47fc260a2f15b70f86a29322fb73205ac32cbe6e381c64cbf7d473ce71bfbe
MD5 f8479c6858947e86aee3891a63ae4e05
SHA1 43d20dd7dd964038887a50912db4bacb5652a9cb
SHA512 43925bad8f86e4cb1f3c0d08603845408ac60c96222114db6964e362c2e4571306b6c6b17b2deaa9a94d25c617828141ff8c4584622cf93becb554558ba0b8d7
SSDEEP 6144:ipJdQRAvPvM4cWf63JzjcJKfIXm/PEJqOYmXjoIoOmIk0+Bkw:GwG5CJHcIfroB4iw
TLSH
T11D442384D21A16C1A6814BF4ED5C2836E2397B01ECE5F64DE39D1E293C09B2E94F47DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 61KB
SHA256 60faab7f2a5e37c0e1f3f98298c30b4dbbf99b7d630f713e81f6576ecac2f8c1
MD5 4f2df2b35dccb6b77ae2eba1d08fec66
SHA1 180132b6064f8a330b763452d2f18061703c3a92
SHA512 8a901dde9eb263f11995bb1cfb740860c08e27c0d210e35e097b27032f40c9d97fb95164f53876b9af94140eae0532491547aeafee21a1d6e49b4c1ebc55fe3e
SSDEEP 1536:xvOH1yKdQVkVbcTOF22yrxrbBibW8kczjygijDijoXKhav:REp4wISgfnQD+gijeNS
TLSH
T1155312EC9099DF3834ACDA6B4A7719E86940707AC41BFED0A755A863819923307F03E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 109KB
SHA256 7e52f3ef301372d40be2c47818e9266714eeb2b21c0307bd042cc895ed13180c
MD5 149d607e4080aad22344c12ab6fff518
SHA1 537f99e7c35cc2238ccc55174cd1589d8f307605
SHA512 834e863587f3c859420574d2338ba29a51c76be1eacb963b3f1489f8426c24ae9f75f2cc2fe4f1729f3c8c15f5a30ca40af35290b346cc90e62c53bf3c7ccede
SSDEEP 3072:y7iRU9alK30gmHgQsPZXENn1485uC/ARRwaZU:IiQalS0grX7JC/SqR
TLSH
T15BB3122CBC5637D40D2826DD1CEB57EACC4337646E85A2BE46D17C4B7A23F012056AF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 379KB
SHA256 25f6689e83a1f6e7ad33de10220750a8fa30b7f0d8657602333884ddacf03885
MD5 34da732248c76b9063d2f91a76d8176c
SHA1 1c7b83dcedbcc4da01212c5906e5d511e62b6f27
SHA512 a87bf3e956dc59812d5662a0026f643b79712ce3ec4f1fec06cf6cc21447789122f3244d9c09bcc17816465b94f58d869b981fe8b48cceceb8a2e8f6ce284997
SSDEEP 6144:8rH05EU1SKW9XsybE6R8x3pemhoqLStVfHIV5gNXWsRlwwvMbJDMIf1MVXnvpg5C:8705EU1SKW5sybE13p1SqmLHXN5HiOI8
TLSH
T1FB8423E1272AE1068D1B3EE24BF5C617581F06DD4C65242E0F6DCB234A79E24EDB219B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 2.9MB
SHA256 949d11b116e40fc5f72e8e0a48055037eb1bb6c9f7d72ea9ebddc494309ffb9f
MD5 bbbd90e869cfa736465238f249892086
SHA1 1a2292291ee3a05754402ca756f556154fc5e804
SHA512 ee345fdf83a8e725a68237e769125d85b77eb3efba6e9afc92a79d8e369c14bc97ebdae9894f1f3e16257c71e4c46ebf918052f1c208dc69f6c478a076ab6166
SSDEEP 49152:r1VZ1y8VBo7Fj4A3Ptl6vEVGKImy4gCGrJ2c2Ez+tIZ9POGNL6JcTdVja:r1VZ1y83O4Al4qy4cr4c2EzlOGNgSVG
TLSH
T142E533272EFB4449A16C01AFEC6125C6910D8AFAB5FEC4CB5A52DC038DA0AFD55ECA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 405KB
SHA256 78b41d9a047b13253d77a5ac71f1f173fa2eb7d1462f7c74e3045399e1ad9679
MD5 d28d59ca1b7fa383c8bcbb3cb3c05826
SHA1 3dd4e1579e597e58cc99b7cae8a3531a37ecbab3
SHA512 3688733f0984eb4673a48658254d5e7719f015608ce314e18b9358880f353b236466cc43d1e94cab11334e809421981304575b222587a75864ae80abc5141c66
SSDEEP 12288:2bAh4dgv7PY90HRDX2lKVv1NN3FJYoFjBA:74dCsiqudla
TLSH
T1CF94234E14A32813AA581EBA772639DB818730F6C71D2853D0516EC2A6F67B01BDFCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 37KB
SHA256 8e401b056dc1eb48d44a01407ceb54372bbc44797d3259069ce96a96dfd8c104
MD5 3d6549bf2f38372c054eafb93fa358a9
SHA1 e7a50f91c7ec5d5d896b55fa964f57ee47e11a1b
SHA512 4bde638a4111b0d056464ce4fd45861208d1669c117e2632768acd620fcd924ab6384b3133e4baf7d537872166eb50ca48899b3909d9dbf2a111a7713322fad4
SSDEEP 768:YLYEgWfC/zlP948Q4NxhBiMwYatzdYZyXSihSZ9ia6UBJlly12m9U:YLYEszTFQyxfiMwYmxYZ1p9ia6U7r4U
TLSH
T17C03F2A4977838297C5335AC14A12A4FF94104FE67EDF4FDF206251418C36269857FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 437KB
SHA256 489d14d60743d291c68212e0529adeffce23609bf69572827b9e73dcdc080b21
MD5 fff2076df2471c3ac9f61f0ad52842c5
SHA1 31bb112f2ae776ce4971298613ec20b3a35315b3
SHA512 ef24ae57cd6323f4f161753f34e1116a3f2b763a089c459d7c80a29b2e048c6eb86a15855d1c5f34819f1196acdc5f0bbe080166598414d576e8ddb4d85c5611
SSDEEP 12288:9kMH9MHd+O0z3EAlFyr7LkyfSAXy/QYZSchr/C:u69M9+x/csEyzEchr/C
TLSH
T1869423C4BFF092E76B49BC2929C930038D6ADD06553734DB72BE013245BB348AB566DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 20KB
SHA256 043893eb762761f28ca6b64ab44db175977312e209c79b9b3c99ce57b9366c20
MD5 506db04b3ac4da3d90354f3e8562e351
SHA1 abc7f76876317bfd81d7b9d56d4a159d4e6e69eb
SHA512 906b1cdaa69afce02b688d462dd4e4c507d75a835e0104e3b379efd8feb1247512b532ee695fcfc37d821801e17c0e505afcdff3a4dec78f6227c4345e747f24
SSDEEP 384:Gz7/guCcuHhR0PJJE7sa6B1+/hAltDpMyCbBImXOTRLNVDtFoI3llgkRNymzN6pO:+YuCcEhRqoK+5ennCb0ThfgWbf
TLSH
T11F92E227CCDC02E6769C277790FBE9719325D266DE5132636AA408F12B213E8E661D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 38KB
SHA256 ae99aaede2f373187a4fe442a2cb0ab9c2945efbab01cf33e01be517c0c4f813
MD5 71d3e9dc2bcb8e91225ba9fab588c8f2
SHA1 d7e38ee4c245f64b78eb18e6ecd7b9f53b3254a8
SHA512 deda05ebd575d413aa2277876991ecc2ea238907390753485ba1b487ede2f432363c46daad5f3f240eaaf8d3258150829a3ae3d2d9c420ea59567cfd440361a6
SSDEEP 768:90TMDBOLlFMKbQDweRs+mkq4oY+VT6p+0t5LMXTkfm7s/U2Uq:6TppGKMDwtN4orTAHjMDja
TLSH
T17103023ECBD95DEDE717731B5C822B05683C2B18D0BD9C498995A2D04ADBD01F8CB2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 38KB
SHA256 440ad8b1449985479bc37265e9912bbf2bf56fe9ffd14709358a8e9c2d5f8e5b
MD5 7f63813838e283aea62f1a68ef1732c2
SHA1 c855806cb7c3cc1d29546e3e6446732197e25e93
SHA512 aaea9683eb6c4a24107fc0576eb68e9002adb0c58d3b2c88b3f78d833eb24cecdd9ff5c20dabe7438506a44913870a1254416e2c86ec9acbbcc545bf40ea6d48
SSDEEP 768:RtWd6RsrMjeX+oUMPzo4niAVyynUFTyEatQHzV2h2TzpLJD5JoswdZB:/y6RsbDRzookyncNMQHzAALRovL
TLSH
T1FB03028CF413FEE931468F269BB700857442C457F997A72A30F5BD02D98B6286214FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 38KB
SHA256 13da02ce62b1a388a7c8d6f3bd286fe774ee2b91ac63d281523e80b2a8a063bc
MD5 ff5eccde83f118cea0224ebbb9dc3179
SHA1 0ad305614c46bdb6b7bb3445c2430e12aecee879
SHA512 03dc88f429dd72d9433605c7c0f5659ad8d72f222da0bb6bf03b46f4a509b17ec2181af5db180c2f6d11c02f39a871c651be82e28fb5859037e1bbf6a7a20f6b
SSDEEP 768:w35mZVsqT7RAo+6tbgLdolT9YSswcTWa+O/dm8ae41u37qt+:1xTO3kb0dolT998WhO/Hae4jt+
TLSH
T11B030292A14018CA6EAE219576CCC7A7F4745D89DA081DD619CD01F0FCB326BBB51A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 08013a659c1a37a34a8cef69c0dc387b172b72b76ac9808ebc83287a253b6268
MD5 68ee130b4ba37dbb568a031523b2ecc9
SHA1 b3e339e63b0b740bd3e26e280c5ad5fc6397303a
SHA512 633f94c4dbf4fecf89de4f6344a0991e4d0cd1f95db219e9196b960a6ff6d6424f19f8819adf5d266b728671ab212640308f29e4d82c9241fb8f4a52ac2ec993
SSDEEP 96:kFYdZoPZSChc+WDD/h316jrrLFOv2fjLp1Twj3qWID7Oa6qOaiUt3aEBud8:kFYUPZSCVoAFOvcjLb8WpDKQOaMKq8
TLSH
T152F19788436FB9C9CB2FB6B510D89A9571B2D745168BEF632F04EEF4042134D5A233CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 f8f8567844edfc04e5d4fae895749b7be6ed766bf41e10a5d9f71ac87f5053b2
MD5 fca71a5298b2d8164e26422398b649de
SHA1 265f575b3bc96dcff1abcb8cf5b56b74ad486e8e
SHA512 f84ee6810a31d98b12934e5f6a9286dd2519f0fa29be71029c3a39cb47f41e424f43d17bed51d6257ec5ab01a2160032db7afd0f6498a0be8e4fb01bdb78ff3f
SSDEEP 96:+FYdZoPZSChc+WDD/h316jrrLFOv2fjL6P1Twj3qWID7Oa6qOaiUt3aEBudg:+FYUPZSCVoAFOvcjLa8WpDKQOaMKqg
TLSH
T19DF19888435FB8C9CB2FB6B510D89A9571B2D745168BEF632F04EEF5042134D1A233CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 c42a0706d3d064dc86f72961cf5faa8ac9e84b5bb646c09e57d767d9c9ee8d08
MD5 4ea77ba12fe75efd409cab3f02a51d97
SHA1 a492fbad07a04e45668d6170184f5fae71f6b1a7
SHA512 6d230266372b8feb226d4a632f786505bf937fa82fb1c8c58562e5a2d739de4c65a1edc06b22c3fed9d31cec7a1da152d22b0dfd6d4f6e08808e5bcbbcd485f3
SSDEEP 192:2LU68uZG2MVYRxLqOykbtLLWCeFwO7HGOxzEHFp:2onu7rBp+deOSOxz23
TLSH
T1430231484B2BBBC8C76F72B011D99755B27AE7140667FF622F00DEF419D930D1663289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 e74e6b47481bc2236188b174e46273aa03948cf099e49688c1500cf3851cc34f
MD5 dd337ccb9a99b99251db39bf7655cd3a
SHA1 4cbd8b28e60cbec618400191eab6cc781cc3f8b5
SHA512 4ce75be9e27bf7e8c3771130c69d70dece14b05d59fdc462685cb35e7587bceab620cc352ae372e3b550c2482f58d01580e9a5fb6a81e623a81b232ed2455ece
SSDEEP 192:tPSUyGmL8DSKfMkSjXiFKmAhnXOnWwxot2Vk9PLWUeRqE64tQ/m6j0HLERdobtjc:ZFlDJfo2GcO2YPl
TLSH
T16F022E58839BB9C8C7AF72B050D996547A72C3290A5BEF63EF82DDF2501130D27632D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c82f6c694d9c0f10e3144187a81bd1e45102dc3ed4fef8db59dd57e60b99b5bd
MD5 e63b7360cd138bf63c41e5bfd4d368cd
SHA1 beeabf6bf2cfc1ba65ff8c9990d8adf5b2e1abc9
SHA512 63318f24f24157cac46ce3045acdc27d70b053cb13c70f9cdd688422d8d37aa76aa5b47b20c842218652daa6b5916038f6441700b1b75694e17ea42f4bbf4843
TLSH
T19E512298832FFDCECB65F3B220E9BA89B6B3D459694FFFC04450977449013462372221
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aebc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aebc9.TMP
Size 2KB
SHA256 2267fe70f60f7311ec41dd47cb2f85964b14e24dd5228f9dcdefcc21fec363c5
MD5 9e084ead3ddf3444e8b81d162b0b78bf
SHA1 50c487bd119ce044aff433787efdb7c268c88aad
SHA512 13917c3201d15b6ea2d3ba0713025f168ae6c7fdea0f2ec3e0cb96fec8dfa753b4d8a1c7f62fa428b7e7788507855fa95ed7ab509ddbf3e2ebebb679d574505c
TLSH
T142512298832FFDCDCB64F2B220E9BA8DB6B3D459694FFFC04054977449013062372221
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a2324b717add148654f9e43dfe6e723ac4233c9192a5b3d081cb508ab3db31a4
MD5 93d304e0d6388a50530b9f87bde2d74c
SHA1 3a4e85d720e65516fe44a1b634744c5b6f969331
SHA512 6cff0347b19a183cbce44d3b8afba186c51a3de696724963801183bd2ee2644069bc7fe4a36b6f476ddd6ec1d0e99630ce1c0702904a7c0d2f6ffa6e1260991e
SSDEEP 96:Duru7uRu5uluZuWVaaZjhVThuiwTiu6oeu/5u9uUuCJuxAuDueJ:DmWEQ2MlVaaZjhVThdyiSeO5mN7AAcrJ
TLSH
T120B199F3C7E9836DE91152F49A183E1ECE2D1D6443283C2EC9E59E4B93E2571E181A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e01ef25c0134bc34464cd12b307bc34d9ea0a30f0be55d49b6441087152e0179
MD5 213ec3ef0a94a8dae344a113f819ca87
SHA1 00582080c66da45532519699d5ce6b09a6905cca
SHA512 9ae74825687a7a4832e24979fe9c08dc5760d1f6803cc5e0e22a4eb94f2ec160a817e50d92ae20863098a45b2228a0a9ff844824f3bca4e3a86be7561878786b
SSDEEP 96:Duru7uRu5uluZu+up0VaaZjhVThuIiu6oeu/5uTuCJutw8SuoueAuwvx:DmWEQ2Mdm0VaaZjhVThPiSeO507UsZrS
TLSH
T146C1ADF3C7E9836DE91116F49A183E1ACE2D1D6443283C2EC9E5DE4B97E2171E181A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 daec1726b1524cedff434ee1908ba2a4a18dcd7301d7d3abaddf0074ac4990d2
MD5 e41140d7ec785eec33f6560824e4da5a
SHA1 f8be9703b5df2a2be4fb21661b276dff927c0ce5
SHA512 85afd36f665e8d5ebbd8ffe60ee0c1987e1e28be204fcde155dbefa5f26cb550e55990f19adbc8acaa2ca32163ff9d279e848ad84270dbd5c376d93be0ad5252
TLSH
T11B319BF7C6E8567D8A0185F87B143E1BCE2D0854432C3E5AC4D4AF5BA7E1471D28094E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3be628a55f7ad758bdfb0a41e5e038e60171e93030c5e3fb0115cbd71e3c23be
MD5 239d880e752500e741a403bba95fc861
SHA1 7f586cd7ceebca94972e09f5acdef25c9ccc9b9f
SHA512 c0d076d455147a82571a4329e49764f7a2a7a31a7e6999933279f2503fff9bfe1a7a34f62a27e453c368b12c8a5d201faae48c65c9e468602b8dc3ec385d660e
TLSH
T13661C1F783F8867DDA1155F4AA182E1FCE2D1854432C7C6AC9E09E1B93E2571F181A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eeac45148081a65753d6965b9b3aee3aac1ca4276de16bd142cf61dbe8f43858
MD5 73c137484d2eac0843142f6c2e539b5b
SHA1 cb432c50ce51667e1d4b3ddcf43f602d54c5a548
SHA512 88fd6d5b2c82f32b780ec2cebe6ad836dbe6ba224ce81ae5fe857a6bbb6165220e6ae89f3435db95e018c1d890e24c3816721ddc7d785dcfd0ac0c6ed5b79885
SSDEEP 192:sxRDrCl/fiscRjXZlDJzoA8pTT/g6+WNpx2X+0GBp2zyijnePZOiFGjIgDWqJ:sxRDel/fiscxpBUH/5mX4T39KJ
TLSH
T1B952C756A964697B5CCBE21DBA55BB53D3F91032A1D41F48FEFC861C04EB6DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 708db3f4e36691a1bd0e27ac8ad7bee2bb623bb7e5d661d94aae885f46373bf4
MD5 ee82a2f4f6c451bc620216fec1b0a935
SHA1 8590e8daafc36019f370cfe66df5fc938482526e
SHA512 587a6694cbb1d6864a7e66a31388ed9fa295605067541490c955a6bb787eae287b60f633237f61c3ef7b818a782a8feb31e02396397dd7911556b7bae2a8f1e0
SSDEEP 192:sxRzrCl/fiscRbXZlDJzoA8pTT/g6+WNp6px+0AzyijneSZOiFGjIgDWqJ:sxRzel/fiscppBUH/5exzKKJ
TLSH
T13F42C756A964697B5CCBE21DBA55BB53D3F95032A1E01F48FEFC861C04EB6DE120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dcfd3da1f918bd55839fd7ce17b8b46d5652e7d55c0ca558e0c0940d54730973
MD5 8b1ce4a3a2dacfd14223733c668c9140
SHA1 6499f77e4589e01c637965f9d571c5844e8a963d
SHA512 b7cc1d5894e9771202bd22f0014cf9a3b6aee5860ecb3ccecc75aa5626f801f12f8c4f661c45ba4bcfcad2bd1c99e4dd86254d632a34f4b14e0cc31465c05a99
SSDEEP 192:sxRUrCl/fisZRq8bNtJzoA8pi/g6+WNIYl/iFGjIgVmJ:sxRUel/fisZI8tUi/5IvKs
TLSH
T1BE32B8566E68A93B4CCBE25DFB557F53D6F9503261941E48EAFC860C04EB6DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dc9077bbccb34fd9f270872d26f84456dafa6ab72bc863e7775734f9e18bd567
MD5 1b4bd9fd8c921bb5c2a430ffe074d400
SHA1 b7c9a4615ac3b2d32c231231113d1ce70b38d0ab
SHA512 d3677c07c2c9fa7a8fb85d453c486bdb2dc8feff286467331f04c6654a27ef63e9dd86f977e5e4f406bedeff29340848bbc7b4f40a108ff4dbb521873a5a7c31
SSDEEP 192:sxRPrCl/fiscRb8bNGJzoA8plT/g6+WNpvk/YlVZOiFGjIgD0qJ:sxRPel/fiscp8GUh/5O/8Kv
TLSH
T1A442B8566D68AD3B4CCBE21DBA557F53D3F9503261D51E48AAFC861C04E76DE120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c9526e13e486dd637099d7c0eae67b656209b707910eda82a0a7ee840a58a423
MD5 6f7e9b9a92db2b3a7ab91da5b7abf5d0
SHA1 2f5f7cc9b3760881a4ae12aac1b174c214d5fe8a
SHA512 5cfd4e534082d25666f5535d2cab3518c44726a2fdcaaca15410f28b415fdc365144166ae9a6974f515edf2c002dbdb316a0bc8f5941f25511cdc3d0f0874e5a
SSDEEP 192:sxRzrCl/fiscRb8bNGJzoA8pTT/g6+WNpO2Z+0Azyijne6ZOiFGjIgDWqJ:sxRzel/fiscp8GUH/5ZZzqKJ
TLSH
T19842B756A968697B4CCBE21DFA55BB53D3F95032A1D51E44EEFC860C00E76DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 086fbe974e418226add49bbc4102e94d5b561ce82d476ea31a75c007cad096e5
MD5 db7b9e2034b43928cb29542c6669c0e7
SHA1 76888039d7d5865e14132a952ba7d7bf19141806
SHA512 0a7e0f62c01a220a83301cb4db094ccf2df5a48e4f94ef07a3a80732c8fddf7030bb5a0364aadfcee13434bdf6b4bb0de03c1add92ed2af6524e797b727cb3ae
SSDEEP 192:sxRPrCl/fiscRq8bNtJzoA8pi/g6+WNIYl/iFGjIgD0mJ:sxRPel/fiscI8tUi/5IvKX
TLSH
T16732B7566E68A93B4CCBE21DFB557F53D6F9503261941E48AAFC861C04EB6DE120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6189153f41aa77e0555f38c881bceed2c19fc06ea52ba0314b2ef7a653102be6
MD5 94d823281966517e379a76f034073b41
SHA1 4fcfca32fd86685d85c963b8fbffbf0cc92cc6a0
SHA512 67d653ab3b1267bd2da6a776eeef1a20544a80ca83a01e64bf85df93d0ef218582a0cb05fd22d1214703e873bfd0445fde5e74730d3cb4c5f3fc7a2aac47ff91
SSDEEP 192:sxRPrCl/fiscRb8bNtJzoA8pi/g6+WNIYlqZOiFGjIgD0mJ:sxRPel/fiscp8tUi/5I9KX
TLSH
T1A732B7566D68A93B8CCBE21DFB557F53D7F95032A1D41E48AAFC861C04EB6CE120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 855dc846485ba76b87443c3cbf7f3aa32f37a584c7c378e01ccc19a93df6faab
MD5 5333fbc478d49592eac58707dce69ba8
SHA1 5282a8473a2f0ebda66fb7fd8f1269c154af8f5f
SHA512 bc43f1e4ff29c9b11aa69ceceedaf4bf5a781dbf15c4f7bc14aeef0dced683cceb49ae414c2a543c505034c21505b83aeaadce65d8df298237b3ca00c8734ac5
SSDEEP 768:dofAaj7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY1315roFN:dofAaVE7AxWgg+fJJu1jazl1yFN
TLSH
T1E4C2EA3B640CCE7E4F804ADDEC19BA9B6D6802CB96D8CD8047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\86cdaf6a-c5db-4f69-a3b2-383ee37d73f4\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 452e8a35749b2f42273812310fe1bba6955581e0a0a355882a7182e10172fab5
MD5 6734210903d9a5e92c486c6fb631d703
SHA1 3ed6c6b89828e08457cb07f412c9aadaaa40e493
SHA512 b57c84e21755cdd1de4696321653066cccbbac4fa3b1916d23a71463a12388fc826b816efa07ae95ece7b2f84b51c491ac2f4480beb9144541850263673cc7c1
TLSH
T161D0971BA08C82A0CAAE8A834B12045906343CC820C9C048B413001B1456A03D281EC2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 5cc293343a94958ecba7f145ee3ece41a2440cc15c1ebdf5c7997e86c7410c62
MD5 f192b72f0ae5ff8d74b5b4fbc5204b85
SHA1 cfe55b2274af842a0b3b902b1a0b7e56f42b9031
SHA512 331a0c20a18c6c43bec2fdd6d10fdaf15986fa52594e11db32f992f188db41a65beb141606386d92723d5dd39d30f273e7f7770a3585d46be9c44e0b6e1fcac2
TLSH
T11AD0A71BE09845A0DBAA4A938B22459E46346CC924C5D149A513641F2476A47D391ED2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b0c03.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5b0c03.TMP
Size 138B
SHA256 c1c17b1ec99f39cb96801ef8859c55306d6cad4c77104c264fccd77b6775f049
MD5 9cdca581e6d2e7abe8edc6ac894f70f2
SHA1 ddc8c48f0cf4c2b4cbf6a59948d2ef8e0b88913b
SHA512 f3df4f0278e02b69563acbfc931febf58436d0bfc4e2023ebfbb12ee9d812c93665384402813f78d36e0d3a2af9c54b040e41b6b304cb85c50aeb7da08485d26
TLSH
T13EC02B67B2480151CF2046830733460C47382CCC28C2C48D700338152074E23E301ED1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\e715b7a6-deb5-4d4f-af2d-282c13e09ce4\index-dir\temp-index
Size 72B
SHA256 b4da6555e118cefb9f844174b299559c60a71a6075142f72360af91a116168de
MD5 babcb71bf3a9cd2caea6411403ddec5c
SHA1 e3b29687ea5cd76b7a420d62f143377e6d62fc2f
SHA512 6eda2790128898e105f2af27c3f64ce9b1096dedf6b5cdd561756221801ce8171b70063f511b0e869d617a7754ca8114f9425f933d007e799051a543450a3fed
TLSH
T15BA0029843C51494D01911B560550BE22310CCD444101B4346A051CC8D541C49911015
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 d50a568b2444d5c789b87e8641f6afb6fc1d0db33c70a19f4852276a41c98fa7
MD5 3e2723dfee2977792b2125dbd92f7374
SHA1 259972ba2ec32ccf299544b624ead4512d337f1f
SHA512 5a72ae9dcaf8130049bff330f222926b337b599aec634d57f86339ed55503a8dc9dfb8286e94e30fd00fffcf1d41fecb8444e76861114aeae5f1e3f249396dd8
TLSH
T1E5C08CBB90C185F22F7A25EB011332DEC93A7FDC4DC5AA4CA422305C2238CAB2010930
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b848e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5b848e.TMP
Size 178B
SHA256 dcb0861a2441e9b4f5ef51b7c737fe90c7ae221207868509e6f5b283eb71b4e1
MD5 e1f6dbbd270fa7fc525259979bd34d07
SHA1 4f72ba11f81a7d381722b2ee101058427a76b3b9
SHA512 5c76542db656a101a17a67564b9a129cb4f2d5e6ff77e0aa3c155a49a7e563739df97428e778c294659976c2f4878eec3d9d6c1dbad5ba53eb51b17eb79ce7ef
TLSH
T179C0807F518195912F7424E7010273CCD5367FC85DD0DF4C4451705C3270C2F1700924
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b628f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b628f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f993ce601ea1ef38d84fd73a29485f373c7804a4cc470f8f6243b0c95a61279f
MD5 2d2975fbd7e6a88f82d6e303bacce579
SHA1 1d39b73f32a32cec9a13cf65d3c19c7078abb4c7
SHA512 9561dda69cee28afda247417076603455625e0adc7405455d1d7e00755875f3225c8f32be708ea6cd1761c311755606a6afc5d9c09c72d51a4cd1752fcdaa877
SSDEEP 768:arv+4UNbdM3Mq1iJ/vCNHXmTWTbc+/WeVH1SvyZ:absb+35WvueWn1eEH1dZ
TLSH
T1CB03CF319CB98F37ADF79688718BB6573EB8116389C40B84C9D97B4D428748D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 dc78874536547fb65206158b1aabe10068f07a1887fa4d6c263830ce0097e7b4
MD5 3ab4bfc5f87a6a8904258e0aa880aa87
SHA1 c9ae537a8f21e0b92cd84b83178c6b16f8e6dc3e
SHA512 54a0fe584abc580970619b794325aeb18c5e2235abae3a3a683a67e6932e37bb75a817132c896489ac9b398bdda1d4cd3d18dbac5924ba1c579f0484edc3cb0b
SSDEEP 768:Nrv+4UNbdM3Bn4kiJ/vH5etWNHXmTWTbc+HJeVH1SvBy:Nbsb+3BWvZ8KeWn1pEH1+y
TLSH
T15813CF71DCB99E37ADF69688B54B7A537FB8116384C40A88CCC96B4E428708D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 27611608695b8943a3c236f6ea84e201470752254c5ab2b648ce7c9cc2bb9568
MD5 383b6e05a91f18471befb1a919939b3f
SHA1 3e90de5ccf9894839bcb60dcc15f700ad02ce149
SHA512 8f75b5d0505eec509e71b859c36dc135d5ee2a2d72b4df8798f50e01369b26585ef15605b944cb2f4b9e61eec7763764f811abd4d78fbe8ae149aa078d42c678
SSDEEP 768:WFQj3NwgEn0Bc/vH5et0NHXmTWTbc+HJPi9PGtj:dj3cvZ8MeWn1pPRtj
TLSH
T17D039EB1DCA5DB2BBDF69BC5A60A77469EF401A3C5C855C4DEC8AE4D01C319E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e162d47e1743e82a68f0cdfbae4ea602ea97186e4ddb8aacda4231359054b844
MD5 db8735fd6f4ea98569226b368aa48542
SHA1 928b631fc1668f0a216569dc3018ec2de6e29c80
SHA512 21abee8a55357a2f209ef6277411613ff82703f6383ac29fa1ed2e0cc08402752bb351b2ab6ad908a6019d71c890db37e916466c47597419adcd3a363eaa0afc
SSDEEP 768:hrv+4UNbdM3Cn4kiJ/vH5et+NHXmTWTbc+HJeVH1SvBy:hbsb+3iWvZ8SeWn1pEH1+y
TLSH
T1CA13CF719CB99F37ADF69688B54B7A577FB8116384C40A88CCC96B4D428708D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 38ce67c15b54f8bc362fde058eb7a2707568ad46c856ed3d0e2e98b3d23cb3cc
MD5 0e66cf48aa3eeb709a5f2ac6f98cf655
SHA1 70d981c9994ffa58491c5d7c3061b8a6a313eaf4
SHA512 7697d96ae85693896e41f69685dbf4b1f4d2af22f3453cacd32b42c476f37510170ac447453731eb4757bfb1f6534ed9376c98ff2e729a0ad806fed0800c4cc6
SSDEEP 768:prv+4UNbdM3Bn4kiJ/vH5etWNHXmTWTbc+HJeVH1SvBy:pbsb+3BWvZ8KeWn1pEH1+y
TLSH
T1CA13CF71DCB99E37ADF79688B54B7A537FB8116384C40A84CCC96B4E428B08D070BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 31f6af46c90110abd57c9f6206a281aba669ae30321c9230eea4e3266044c232
MD5 611326e6a8d023b6341aab39e73690db
SHA1 a2e87d535c9e559cae22d4993e6279ee8bf2b55f
SHA512 1e460c3391f58c1d2f59ec93ee6430abb2ebfbd845fb1e80cc0869c4be3a0b69405a7e1a6c39a14b92201b50d4a762c86f972f593117065378dd81da83cec281
SSDEEP 768:Qrv+4UNbdM3On4kiJ/vH5etWNHXmTWTbc+HJEgS:Qbsb+3WWvZ8KeWn1pEgS
TLSH
T1F303C071ECA9DE379DF79684B50B7A537FB811A388C80A98CDC96B4D418705E170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 72a29476e879f6276bdab9ec47398eea71ef09b02c719ca284a290ad778c8b59
MD5 e74c6f41a67d2e93ff2ff6a5448bae7f
SHA1 53c1cb998862b674eaa943eeae050c4da4d4e1d9
SHA512 33cd415b5c2a9d05f3d8311aca3e5029c3d368acfd8b678b78196219b8b56b596bcff1557e1cef34c049f34e759d56232ead22aecfd8528f6224eb005ac47804
SSDEEP 768:WFHJ3fwgTnNoc/vH5ethNHXmTWTbc+HJPi9PGtj:aJ3/vZ8XeWn1pPRtj
TLSH
T1751318F198D79A3BE9AE9787673D2E459DBCC163B5881584BBC85E0CCC8207FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 247dd1b3aee2acc67951b46ee40cfddef1a000d8e481757dcd4e39652ffcf0de
MD5 bd6e165ee81ab5b529bb9658ee3b9711
SHA1 8ad57e013034cd121a09e8929d0afbf86a970a3d
SHA512 7594a1c54d2b683719d4865d13521146244c3cb35c5390335ebee07c010a8e648bd2c3f9ad78f4fe09276be2283eb19d06e46371bdbacfaeba580e70b135936f
SSDEEP 768:WFeX3fwgTnNoc/vH5ethNHXmTWTbc+HJPi9PGtj:NX3/vZ8XeWn1pPRtj
TLSH
T1D51318F198D79A3BE8AE9787673D2E459DBCC163B5885584BBC85E0CCC8217FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8239084c26e7ef9b6fdb344dee303ce9306a914cb9aafd5782c6f4ed8dae33f2
MD5 2c0be77d2ef0649235be8fb33d731ae6
SHA1 aea15ff862151120568ab280ab061b808370c64e
SHA512 7d0987d3994b327e39c08e35c68d55ac02a3d74cbdc66bc883a0f404092f9b964e0e45f888a769958875a2e64266068b8d31e65cb05a8cf7d499a2a4ea62fe90
SSDEEP 768:Irv+4UNbdM3On4kiJ/vH5etfNHXmTWTbc+HJEgS:Ibsb+3WWvZ8peWn1pEgS
TLSH
T10403C071ECA9DE379DF79684B50B7A537FB811A388C80A88CDC96B4D418705E170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e9a99b73ed4fcd5324ce00f1b8ecb3b2d8dbc2186c7ea6b6f4517ad63e211127
MD5 356387f54fe80c58a4b9fd3e0689bba0
SHA1 74a97ff0b69822b1dcd726aee3bbce7e7dedc288
SHA512 9ea5e5e25c2390859b834515368698eee73b56dc0ba4ca2583dea7b953508a6d4b1f10a18b4f77684fe1e49e4da2c784134a0e0e285a750f524d368dfb2df241
SSDEEP 768:WF0rv+4UNbdM3NwgEn0Bc/vH5et/NHXmTWTbc+HJEgS:Hbsb+3cvZ8JeWn1pEgS
TLSH
T129139F72DCA9DB3BADF797C5B60A7647AEE401A385C819D4DEC86E4900C709E170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 aa5027f38350074bed2fd39f83de59c0151460c0552bbb5f00135e5452ea158e
MD5 1c6b51982297d8df93465b34f151bb8a
SHA1 158fcaf3c2a3cd1255140f908fa7b8c8e67ffd7f
SHA512 a29154024cdba77277ad8b352780de0f175bc9037bef5f0264497c3c7ea1f63b812301f5be8f0dc6d901b55131463f5b0f300ddc9d7eaafc84bd48f718ec130d
SSDEEP 768:WFIB3ewg0nm3Ec/vH5etwNHXmTWTbc+HJPi9PGtj:DB3GvZ8weWn1pPRtj
TLSH
T1331318F198D79A3BE8AE9787673D2E459DBCC163B5885584BBC85E0CCC8217FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9ff9cfd69534ed6471cb998d8bb1997de4b9fbcbc33fef51d654b3fa5e9324a7
MD5 744097e7f7959b1904aeaebdb02b031f
SHA1 fd96c35a15bca07244c4712cd16bf06636710e1f
SHA512 4e99e7afae91baa1fc9e71a189bda6b938caab28568a0c7b25eb66dd1264ab0ecb5a41626ea35e00081f600fff1ebc6f7c1e10db639d4ab198e1765b3ea5ddcf
TLSH
T1F6E00102E70000AFE028133004871B202BE2C02102B3138B5A201269BC237006E21AE4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5d85637622b80c3af59c62e92f3e1a21343fbb517e4fc90b105a7b926e1f5729
MD5 302c7b4812edc3e770f675c0f91270e0
SHA1 9aa004afa7b95f63238f686462031c149ad88fc3
SHA512 9f828f94937931d5b3991663484d0e9ef8486162a9ff2543e114c236d2c0dbfd7cd76ff2c7945651a5e3e5e8536322c0fe1f1f9257e09a41a52b58b3ed4b1187
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3944f918418b55f162f03558c3614dd646cfac78ed8b09313c845ed85937baab
MD5 42cfd9444057c30f0bcd54a47adc2790
SHA1 d29c67e781e2a0e4215569f1c6d802e7eb743d0e
SHA512 e50ec3537de7a42f37f78f996ff9b0d3cc18260ba13f49e9f02eed247d6aa4696c62bcf9e9159d1fd608b7fca3112e7f1061b4fbd4f287b27acd71e596447242
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b4ac04fb4efaa6206588e77f2b34688e27d8c08aa0c8f9c2605f8dfe7f9fa84c
MD5 c9f1b8fc07ef105e7d81aa2d74182e71
SHA1 f0bfd25da372d71e52db370f905eb35f39384a6b
SHA512 2d7368fd2f1074f240bc723f3ad5bcfe21d7643c1b18e0b595e859337ee0d40d16ccf19a331565069253f4404d84c27e6dd0938f82424476e88a8d4c6dfe7a41
TLSH
T11EE00902E70240AFE07813B404871F342AE2802112A3139A5A241268BD227006E21AE4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c84f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c84f7.TMP
Size 392B
SHA256 fe9312feb1f3a480cd302fe5dd030c4e18bb862c410181ab7f648a0da133d349
MD5 218b7e2aa9cc2c34cf58a35505decaba
SHA1 436843bfb9825059bd2d9ecf161a923a5ab301ae
SHA512 ef7632c01dc4a7a62d1ba141366e13689e56a58051945b532418b0d11a69e39ae0adf2555c548fbb33cfe5892a866e04926976355b2dc94cc6ab81f5834d0a13
MD5 SHA1 SHA512

Submit Download

b7996734-2f65-4fe3-89e3-5821dc093d4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b7996734-2f65-4fe3-89e3-5821dc093d4e.tmp
Size 39KB
SHA256 499333e8a69460c9383a6da3e7741167fd4325b3e2599717faa491b3e3c8eec7
MD5 ec40c7b4f27929674d8776d8d99aaeca
SHA1 6046525636db8d0d8b589a1e91216ec3ca2cf583
SHA512 453b3bad90432e7dd78323d02a0d07214eb37c74cbccb1cc2434e1f2cf1b0fa30cbae40ee413c8d4a2ff790b8625860edc15add9fb98c553efdab6fbdb33622c
SSDEEP 768:Hrv+4UNbdM3dhiiJ/vH5et0NHXmTWTbc+eJeVH1SvyZ:Hbsb+3aWvZ8MeWn1aEH1dZ
TLSH
T14C03CF71DCB99B37ADF79688744BBA477EB811A389C40B84CCC96B4D428708D130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

5f7d565a-c86b-4f1b-a155-21a868dfafe3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f7d565a-c86b-4f1b-a155-21a868dfafe3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

update-pending.txt

Path C:\Users\Admin\AppData\Local\Primordial Client Launcher\update-pending.txt
Size 65B
SHA256 63c8432e6e5f4bef720bf1fd8767d030d2bf2d29226dcd80a69be2c23c992e33
MD5 6a39d93dfe11f9232f842b1d6ffaf768
SHA1 64fbc31280baa81f0a5d0ab7df685d1907d64096
SHA512 f7e706d64edd2f9ab03118bed6585b71119abbe6682eb2fe4b0b483c79908247317556e22d981f73666f745134f881d8cc0c47384e818aff90becb37ccea5217
TLSH
T181A002A05FB4F5E24C559D07C58822554AAD66C0A1412D5D5F2151C4A34631D5885946
MD5 SHA1 SHA512 TLSH

Submit Download

PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe

Path C:\Users\Admin\AppData\Local\Temp\PrimordialClientLauncher-update-b6aadc5ff8a8b54fb0313038ee8bd0f3.exe
Size 2.5MB
SHA256 ff3767d58402f3e03c1a604195075247acb1bcc3ee14ee7d1f98fad060c6f28e
MD5 685fb3ee7301fd7c797eff43074b7384
SHA1 8acfba7ae5ef229accdef2be30a9232e775e31de
SHA512 51c077cfae2625552780ea88eb2fe1511409778eb08f72892d2ceddf951cca0c81650da24b9eaaf40ea30a1853d2a08091fda06927e982a1fbac5c31d87e2bbd
SSDEEP 49152:IQJL0PabC7G0mg+oKYWnZXUaWwqT67DE1Wg2tBvEfx7wp7XH+:IKQyb8mg3AXUahqT60wgShOx7GX+
TLSH
T116C5334173A0883AFA350475EAD9DFD76273B171388DD45BBF008A8AAEB5C40DD792B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi2429.tmp\InstallOptions.dll
Size 15KB
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi2429.tmp\StartMenu.dll
Size 7KB
SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
MD5 9ba64ba25b26b3964fe1ca1d331387ee
SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
TLSH
T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi2429.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi2429.tmp\UserInfo.dll
Size 4KB
SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
TLSH
T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsi2429.tmp\ioSpecial.ini
Size 1KB
SHA256 1d84c5365d00e3baa79862fa01f69ce9f1f0cb93d75254655eef49eed7ddc349
MD5 298414f4d78dbd743be8e923e65a253d
SHA1 cd725a5d9c9c142e853dfa70810efc3288675ef9
SHA512 e007f9d3d9cfc2cdac2d68bd4967b7474a25d261c1843df3a0e2229ec1913074adf8de6bc4e72b12b15e1831c43715323c0fe970429e7b701be4d205b60082fd
TLSH
T1B1313E136AFD5018E2BBA648EFF580354B79BC56582DC51E95D14A0F48F6B808823BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsi2429.tmp\ioSpecial.ini
Size 1KB
SHA256 4b8960bad67082565fce54d1c694f9e67b11e92c67d6c16480f1b7c975ded56b
MD5 5fd52a37e36a50d009a4f96e30855a52
SHA1 bb3cb60f99a9e8343ceed65e4b08f66cbd7ccab3
SHA512 6f4463766ccf949cca49f6a22006c710bd9c014e94abd8dea0887ba595c395ba6417bdbfc9ce8222cd91b70a31e849f4ec11fd32d67afacf97bca16b51718f8e
TLSH
T15E316D136AFD5018E2BBA648EFF580358B39B855582CC41E91D14A4F48F6A808823BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsi2429.tmp\ioSpecial.ini
Size 1KB
SHA256 d76be7c7f352bb9fbfdd0dfe5c38300159894daf0345dfac0eb54fbce3a28845
MD5 72c0249819e57c43c7ab7d88f505aee3
SHA1 21c69ebe8e56dda6f10a5553c0ead18d8b9f35f7
SHA512 0ea47e415d1f89ad913e96878d59a989afcb7d2c194650b7c8d1827785aa93550fd8c6596bee01afa22602011f2723c69c5817b09386ed8eab9919df8723310e
TLSH
T15C318B137BFD1508F2BBB754FEB540748B3A7C16A838C50D51C00A0E08F6A408923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3324_1777912500\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Primordial Client Launcher.lnk

Path C:\Users\Public\Desktop\Primordial Client Launcher.lnk
Size 773B
SHA256 ab8a42277d5a25742e5618095bb2b5b8860fbf8c84056ff8ce73b9cc32c12e98
MD5 70470fa3d7bfdd962b9850f12c7967cc
SHA1 680864f0060614fab9dbeb83189429ab97775ce3
SHA512 58321516b9a2b573e75a0700c5b8c4e2817adc54e83acdb9589809562fb20a72e76aa51aa8755672b95a6a1b9813311b29587625edf32baf6a41185a049cb7e8
TLSH
T1B3019A208BEEB6ACF2F3837129358B104BB2FC12BBB5C31E1494824F5831A105698B27
MD5 SHA1 SHA512 TLSH

Submit Download