0d6bb687052b6816de9bdbcaae3d512d6cf2316d881cc27488886fd76e720ac6

Resubmissions

18/08/2026, 16:14

260818-tpqqcsvhpd6

18/08/2026, 16:10

260818-tmng8aab426

Analysis

user interaction
yes
max time kernel
56s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NL.exe
Size 7.9MB
Sample260818-tpqqcsvhpd
SHA256 0d6bb687052b6816de9bdbcaae3d512d6cf2316d881cc27488886fd76e720ac6
MD5 bf6f297ac0c32065299c397cee6a834b
SHA1 3a8f42cf99a10420e924b0086252788d55613486
SHA512 c4f2c82d6a5235aac3d85e1b74013c75dfeaf74ca24271fa32d572fcf70a087f148967564df9b84a257b01c775e96eeb035a973705158616afb3348f10853981
SSDEEP 98304:44kJ5kAImHKAlB0bIxSuBXCITC7xg83j/gU:44GkAlHKpbIHCgoxLz/gU
TLSH
T15886C007F756829DD016993887A2C357F371B8111B12A3CB72882A289FD77E01F7A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
48	discord.com
49	discord.com
51	discord.com
55	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1184	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1956	NL.exe
1956	NL.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	NL.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1956	NL.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3228	1956	NL.exe	96
PID 3228 wrote to memory of 4916	3228	msedge.exe	97
PID 3228 wrote to memory of 1184	3228	msedge.exe	98
PID 3228 wrote to memory of 4492	3228	msedge.exe	99
PID 3228 wrote to memory of 4492	3228	msedge.exe	99
PID 3228 wrote to memory of 4492	3228	msedge.exe	99
PID 3228 wrote to memory of 2684	3228	msedge.exe	101
PID 3228 wrote to memory of 2684	3228	msedge.exe	101
PID 3228 wrote to memory of 932	3228	msedge.exe	102
PID 3228 wrote to memory of 932	3228	msedge.exe	102
PID 3228 wrote to memory of 932	3228	msedge.exe	102
PID 3228 wrote to memory of 3304	3228	msedge.exe	103
PID 3228 wrote to memory of 3304	3228	msedge.exe	103
PID 3228 wrote to memory of 3304	3228	msedge.exe	103
PID 3228 wrote to memory of 4748	3228	msedge.exe	104
PID 3228 wrote to memory of 4748	3228	msedge.exe	104
PID 3228 wrote to memory of 4748	3228	msedge.exe	104
PID 3228 wrote to memory of 5092	3228	msedge.exe	105
PID 3228 wrote to memory of 5092	3228	msedge.exe	105
PID 3228 wrote to memory of 5092	3228	msedge.exe	105
PID 3228 wrote to memory of 4412	3228	msedge.exe	108
PID 3228 wrote to memory of 4412	3228	msedge.exe	108
PID 3228 wrote to memory of 3744	3228	msedge.exe	109
PID 3228 wrote to memory of 3744	3228	msedge.exe	109
PID 3228 wrote to memory of 2588	3228	msedge.exe	111
PID 3228 wrote to memory of 2588	3228	msedge.exe	111
PID 3228 wrote to memory of 2588	3228	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\NL.exe
"C:\Users\Admin\AppData\Local\Temp\NL.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/64ujybZsDX
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fffd736c188,0x7fffd736c194,0x7fffd736c1a0
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,16448250154912056740,3995384717773595182,524288 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,9036085206680288230,12087037808881961658,262144 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,10272131930425687946,15982779493921542556,524288 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2115263257394382201,10154107745724616198,2097152 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10039027027213301129,6824159786900018170,2097152 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,7513331143335416827,4297707346489043896,2097152 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,13042222345878102689,13013470870780134465,2097152 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,3762365205795565615,974376914193433401,524288 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12727239489015831562,14141660063819005538,524288 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5464,i,1711078748954215011,5706473427061285861,2097152 --field-trial-handle=2292,i,2700832980757584049,11701172998205956128,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 75fac03b1a668b9b99b17429ff5109b8a1af68affb0526689aa5140134421804
MD5 907389f03dd109a86f89dba5f50f3f4f
SHA1 f448a987d818ea13be4ac6348f8b410d3b188262
SHA512 bc6b0781f22ab6850f5e052e551dd51f14bb77bf5b34712115a0fe087ddf46249d4f88173714deefe2be92852bc671378cbfd024ce18506fcb99eb4c3e741bda
TLSH
T1A9D02366355E3415F72F4271A413D35163AA44737572C301F214CD0E977C4E847D23C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df5d6c6a930d3ea9168de612b56863c9cdcb52860f5aa43ea1dc0d3b9dcc1142
MD5 cfa8d1cd179f8a30c9b7bc55d81a80ca
SHA1 1cc1c49affb51d06a8b81f206f304f32c90d61cf
SHA512 f1bd48333b2c8c0b197fa35042df057442c58d8919602d746d55db8e5df7faa4db384babbb87cfe7a1e03a17d39f0414f774d037da9d9119c1b99df6ad6daaa2
TLSH
T184615CCB0A0A44B1FF5501B0DEE1E69035B3C49C5A1F19DA0D005775B701BE1CAF67CA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589863.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589863.TMP
Size 3KB
SHA256 5f94d9ce328672e42c21578d8910bf7a9c373bb2134dc39bf3d574d25b70baa0
MD5 332b354f83ef6e8f6f75b05bc3caec0a
SHA1 a9fe5282b6ca46310455ccdea291200cd5a3ca44
SHA512 3aa2e650ff1eea477b77487fae6da4288454c1f8f55df5fb080c36d8c83f40c46717c45e955decd712df6e185f5069b0126304a6fd3011b3afa0ecf096c81995
TLSH
T145615BCB0A0A44B1FF2501B0DEE4E69035B3C49C5A2F19DA0D0457B5B702BE1CAF27CA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d9f22909697ef75bfec78ffcf0051e69a3d8103694d048050059badb4f656e8e
MD5 0052e119479be5573407ec0791fbb2a6
SHA1 0b38a7cb240882885a2f65ee479f964b2f6b5d98
SHA512 740a813f5800923120c1e663e7659ccbb10bd5ea25ce810870c70f2242da34dfa0d9d591e4d6d21f86abea5e8131f4d4ac415c1ab5588842178b32bf84d149ed
TLSH
T12B219BF7C7E4893D8A0156F4AB04AE1BCF2C0915431C3C6AC8D4AE1F97E2561F14095F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d7df15285b28815015beb27936d100a924f391453b90bd7e0dfa0add9ca10a8d
MD5 dc475fce468a387778af3ef7689e059c
SHA1 864c7a20c37fd6a5507fb8ce257e057d06a60d85
SHA512 37328d35ca7fe7bf5c56773706f82f1299f126f998c36721f8402b57210da43c1d6eb59acf3cc8426193bbd44557e1d259ae7d5dd0e9429787e14eb2a81417f9
SSDEEP 192:sxZTR6yM/jK1Ml8Kjf/fZsU+LWpVLCmaEdpnDHW6+WN9Cxu/YnZeZIgEJ:sxZTE/f/fZsHLWv+m9DHb1/7I
TLSH
T14552E916AA346977CCDAD30DFA517F53D6F41562A2910E44AAFCCA1C00E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 908d661c3b5d2ab1b1de8098b5afa504c9b07d5ac6d92288ba1b2050fe31ad28
MD5 d0cb9629c7f8e9d1d12b71c81f9491d9
SHA1 2e6906cd7d12997caaf1418ac1601d98241d405c
SHA512 9ba2dfe6ef1b1808bdf51bad791820409e0a260e9ee15432367f6b18f0ba2c24de4f1a9c081a5c0adde7af67fc9b022f10453a964977f92b3b8624c4544444dd
SSDEEP 768:QTUZYGMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RbroVYl0o/:QTUZYGMWvg0Pou1ja7eLZmRopo/
TLSH
T1D2E20A2F280CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA894C02CB3EF512659B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dca19b63f37d827d792cacf61ace4653fdcc8ed90f9c98c6374b241dbd53a810
MD5 24358bb60a6933dca043d46a112cad7c
SHA1 cb31dc6033e908470602e0b7eda73d7d0eb28b98
SHA512 0f29bb3922f4fb3d3cff9f8636618f0b5744b02ad62f945164b2561e5a5ff609362f4e7e96955401b777705994a33e79ce7954388ddabbd741ac973976500bd7
SSDEEP 192:yONZ61VWQmiUy0tgGX5Obd+jvOIF/aU3+YU6:yONZ6WvgGX5od+zOII5YU6
TLSH
T11902D73568287C67CEE2BE49B58737135FA4206BEA552F80DAEC1B1C009769C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 560d6a1d4cf737d3e5e1f995440cbd30be452a2486d7ae1505daf4c64db1711a
MD5 f33354e1ba13ad67cd5868b2031b9c2a
SHA1 41dc820f61d109d99acd60cf50c87ae82f12a97d
SHA512 6b3fd39ad222b4feaa28050feeca86cebfe761a7f1bb1b661d94b75a6984fcb306394b0b0f76787dad5a2e3232d175e6744bf8a04d43ec059703bf28a2530a35
SSDEEP 192:8ONZ61BWQmiUyrtUGX5Obd+jvOIdmjJ1qlFU6:8ONZ6iKUGX5od+zOIdCeU6
TLSH
T1B212E7316428BC234AE6F559F48732A39FA520B7ED456F80D6DC1B2C009779C274BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 eb98dfb7729e7ec917d0b3e2c40c59c59741c9b7b817da5f92062ba8637bfd5d
MD5 b6f6f59fb0d36a93c63ced5d356f69c7
SHA1 e34885e3e42e08f20c2baeae5a61d6ce4bb9b51e
SHA512 e452adffd11dbcd6a4d28979f2f1b1f876cbcfc3bd31a5eef8babec61e024096081b0cf226618e5ede4ea78b5d1bd067b2e3135c476abffc4621faade3e8b171
SSDEEP 384:zKsNYVdcLi1zX5od+zOIdsFeA8tik1okkK4i41aZ10Sg:2PVNOyO0sX82ZK4i41aZ10/
TLSH
T1318208B0E4A5ACF704D6E4C8A646F2236DB4217789895E4CD6F8763D309F6FC2707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

06f6d236-a8cb-4642-ae9f-a616e7d275e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\06f6d236-a8cb-4642-ae9f-a616e7d275e6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

cheats.json.prev

Path C:\Users\Admin\AppData\Local\NLLoader\cheats.json.prev
Size 6KB
SHA256 987809096d463fb907a512b9dcefabd03fd6ce4bea764e041af9316661b46130
MD5 54bb4c80da5ce2706361b7a22ad269d7
SHA1 28dcad4b452c1f36e0111176415848e05a50470d
SHA512 869d665399ef11dcbe53da9ed302161c242c5c9294f6a334f4c181db28c14655578d9ffc7fc954698ba8a4f9957422b6f0e99b64e0e6e4d8cc3d5cdf54d47935
SSDEEP 96:SW+zfGhpkoSO0ppZv7GFXoSpGt4/mTapINPafbHipPYhippYup1:D+ba7XQH+XXMtvWONPazidaQiG
TLSH
T10BD10079D9150C5710425577956842463AAC15C39F8F3C0A7BAC6D8C4F2E82E2AFBB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cheats.json.prev

Path C:\Users\Admin\AppData\Local\NLLoader\cheats.json.prev
Size 6KB
SHA256 175d29e53e47176978622ce6c5faa12916eb537c5348cc866ee4a1d890359eac
MD5 f5648b6584b205fb6bfc2de933c8d765
SHA1 11d268c2c0dc1f1749605ceffc699dc58dc0fb0d
SHA512 705f66eac3ba4febfad904559b6d9dbac8b109b2f4498e2e5ed9cf5f1d33ad37c3182566d537db4d9b4a0f50577691d58d1a419d4f96efa5bc8e30e73dab5c6a
SSDEEP 96:SW+zfGhpkoSO0ppZv7GFXoSpGt4cmTapINPafbHipPYhippYup1:D+ba7XQH+XXMtGWONPazidaQiG
TLSH
T17ED10079D9150C5710425577956842463AAC05C39F8F3C0A7BAC6D8C4F2E82E2AFBB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cheats.json.tmp

Path C:\Users\Admin\AppData\Local\NLLoader\cheats.json.tmp
Size 6KB
SHA256 e29596525cbda0a14afc5c88236c561089ae094f19e7e4a576a8841054a393b1
MD5 98f59069c62a3b57b4ee4c27472a1faf
SHA1 3e5f0ca3a4e5610355b8e5cd88324c90a951e79e
SHA512 6689e0d50543d94a0810636c31cd6a7a80a39c507aa3253a68ab0cc48887a1a4bdda6919bc5cb892414f39366738baa911266453af2cb46eae8d2c5dba51b81b
SSDEEP 96:SW+zfGhpkoSO0ppZv7GFXoSpGt4fmTapINPafbHipPYhippYup1:D+ba7XQH+XXMtLWONPazidaQiG
TLSH
T1C2D10079D9190C5710425577956842463AAC05C39F8F3C1A7BAC6D8C4F2E82E2AFBB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download