hxxps://yap[.]whykusanagi[.]xyz/p/2026-10-02-nikke-ace-anti-cheat

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/10/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://yap.whykusanagi.xyz/p/2026-10-02-nikke-ace-anti-cheat
Sample261004-2vffksde74

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1604	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{79C2845C-3F44-4EC4-B3D6-74C28AE2A1BC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5696	msedge.exe
5696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2356	4984	msedge.exe	89
PID 4984 wrote to memory of 1604	4984	msedge.exe	90
PID 4984 wrote to memory of 1864	4984	msedge.exe	91
PID 4984 wrote to memory of 1864	4984	msedge.exe	91
PID 4984 wrote to memory of 1864	4984	msedge.exe	91
PID 4984 wrote to memory of 4664	4984	msedge.exe	92
PID 4984 wrote to memory of 4664	4984	msedge.exe	92
PID 4984 wrote to memory of 1468	4984	msedge.exe	94
PID 4984 wrote to memory of 1468	4984	msedge.exe	94
PID 4984 wrote to memory of 4356	4984	msedge.exe	95
PID 4984 wrote to memory of 1468	4984	msedge.exe	94
PID 4984 wrote to memory of 4356	4984	msedge.exe	95
PID 4984 wrote to memory of 4356	4984	msedge.exe	95
PID 4984 wrote to memory of 788	4984	msedge.exe	96
PID 4984 wrote to memory of 1364	4984	msedge.exe	97
PID 4984 wrote to memory of 788	4984	msedge.exe	96
PID 4984 wrote to memory of 788	4984	msedge.exe	96
PID 4984 wrote to memory of 1364	4984	msedge.exe	97
PID 4984 wrote to memory of 1364	4984	msedge.exe	97
PID 4984 wrote to memory of 4956	4984	msedge.exe	101
PID 4984 wrote to memory of 3116	4984	msedge.exe	102
PID 4984 wrote to memory of 4956	4984	msedge.exe	101
PID 4984 wrote to memory of 3116	4984	msedge.exe	102
PID 4984 wrote to memory of 2448	4984	msedge.exe	104
PID 4984 wrote to memory of 5776	4984	msedge.exe	119
PID 4984 wrote to memory of 5784	4984	msedge.exe	120
PID 4984 wrote to memory of 5792	4984	msedge.exe	121
PID 4984 wrote to memory of 5320	4984	msedge.exe	124
PID 4984 wrote to memory of 5320	4984	msedge.exe	124
PID 4984 wrote to memory of 2576	4984	msedge.exe	126
PID 4984 wrote to memory of 2576	4984	msedge.exe	126
PID 4984 wrote to memory of 5696	4984	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yap.whykusanagi.xyz/p/2026-10-02-nikke-ace-anti-cheat
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ff872abc188,0x7ff872abc194,0x7ff872abc1a0
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,1179847405299690451,3850816967684761359,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,3166388261884854704,2365043537643282616,262144 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,1226716945405015671,9919061544875883625,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,12478967029629062952,10004233472109436331,2097152 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,14872398996144210429,2942810243847727983,2097152 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,17624766654061628057,17203152997246660942,2097152 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,8131841283355467325,11996340397497602101,2097152 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,9365773292804941618,8842176160679696619,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5491961957704859355,16653386783724883344,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,6164570828847356998,1937583912473706064,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,6164570828847356998,1937583912473706064,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17303855582840124661,11516896216923097480,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,7175328411251193606,12391449161914834808,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,17002775948916764749,5035741245805235785,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,12455960414722095467,3788935868124954708,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,10117691432909367132,11312552226180060634,524288 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5340,i,3044374372941457299,14754555902563205685,262144 --field-trial-handle=2464,i,1496899207667898952,17315900786876688454,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32121b87-35aa-4771-8fb3-fbb071437def.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32121b87-35aa-4771-8fb3-fbb071437def.tmp
Size 18KB
SHA256 56901008e3197c6a858c3efb78915f9e2605434847c058f8c82dad157ee3652e
MD5 d766a5ec15bfbde89781758e4b5d3eff
SHA1 b2ca370cd4f79e0de19246c3e8f067276cae1a14
SHA512 88addacb13deb3e3c789d9fbb30c4b56c7d9c5bf3c0318598c7183c59b6465fd798171e4059cdf8b1017ea7fff6027add145b0d9be94f740470214091138db6a
SSDEEP 384:oZcIhsNPnL9LDLb2TGbvh//z8ExUXQ7JStgOIwZOyvEyHot:WhAH5/D8Q7JSXsrWm
TLSH
T132828C36AC79ACBA29F7A144F58732038F748477A7C95F90D5EDAB2C01DA2981307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

810e31c8-5d1d-4df8-a5d4-17b6bcff2883.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\810e31c8-5d1d-4df8-a5d4-17b6bcff2883.tmp
Size 8KB
SHA256 865db33503b79e864dbd6c6052d40cc2e9b83dee18ba71af6ad9ef20c5c212a6
MD5 987fae2c85fd9e903382d41053053fde
SHA1 e8d9cf03b46c3f04574cbcbdad765f624d97132e
SHA512 97216d03780e811fcd5eee82c2b002e435cec0742c720b3fbd47fd039b3742bf22f937d6e95a04c01806756e3c411b7f010e5273d1bc32c5e54091be926c6505
SSDEEP 192:BONN6JUm0QmiUy1Kso//jjzorB6ywxWjBCJaU6:BONN6+mE/so//z8ExHYU6
TLSH
T1A302C738BC28BCBB9AF3AE45B44737139FA4107BA6951F84DAE81F2D01D725C1302D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

09094eff-2a31-4bf7-90ca-49403293c55c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09094eff-2a31-4bf7-90ca-49403293c55c.tmp
Size 10KB
SHA256 be9c16066d4fcbc68d11caea95dc735b942e5619000eae1763dd21c88b5459c6
MD5 ff309d75d0a73604077badab0dd977bf
SHA1 8a9bf3f267189ad217f79032b4561e22cf3c1385
SHA512 7139f883a93c35fcc17e04c11d5230e551d7b7c07ad2e0a99e1108adf1d9d3639564034396805ee58054995de76b896d127b0c1f0b63ab586f245ec3d98d3e73
SSDEEP 192:sxZEj6RcWp/fURsWHIdp1FSHW6+WN2YnXY36XOIIg5MJ:sxZpZp/fisWInSHbVXX92
TLSH
T15F22A752AE24697B8CC7D209BA25BF13E6F95032A1D51F58A6FCC61C15E7BCD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cbbff4c-97ec-431f-af98-e5bb09ebe0c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0cbbff4c-97ec-431f-af98-e5bb09ebe0c0.tmp
Size 9KB
SHA256 2cdd5fb0c92818f6700d725f7ef2b6aa98e955d35ef2a325f32dbce26d237a0f
MD5 ede18fc610ffca2934a97d11fef4993f
SHA1 b9b196c1ebc7862a1f2259fab9933f9809880a82
SHA512 40e88cfed148f626237a843ae64f9245c0e054eb2d7b2b6cf8be3b8c21a67bfb0b6315f54ce27e36aa4100cb63ac82885604634dc5cfb3b13de4b48043e75abd
SSDEEP 192:sxZEj6RcWp/fURsoHIdp1FSHW6+WN24I3/Y36nJOIIgrJ:sxZpZp/fisoInSHb2/XH9
TLSH
T11722B752AE34A97B4CC6D209BA25BF13D2F91032A1D51E48EAFCC61C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

281a01ce-650e-4605-bf4a-415ba68f1464.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\281a01ce-650e-4605-bf4a-415ba68f1464.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ab3fc68-5bc2-4c0c-91e5-0f19eb785c3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ab3fc68-5bc2-4c0c-91e5-0f19eb785c3d.tmp
Size 10KB
SHA256 4210c834f2eb3ecd90268d227f54dcb146954587d91b6762df11ae5f78dbc28e
MD5 2bf8c98c2701836894b048b6e8d318d7
SHA1 f5c4f79b880a22b173d07af7945287de37b228cc
SHA512 cf33476c97a5b96026bf1cc2d3f7ad4a68dd1083b16a3b02f65a3164795f709b132d59fdf0164fba27c0cb73d7eab3668daafe7b88b6dc1d9bab7dfba92ae6e8
SSDEEP 192:sxZEj6RcWp/fURsWHIdp/FSHW6+WN2VqZY36zOIIg5MJ:sxZpZp/fisWI9SHbFZXp2
TLSH
T1E722A752AE28697B8CC7D20DBA25BF53E6F95032A1951E58A6FCC61C05E7BCD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54faa38a-e6c9-4463-bc13-b999d9bfc2be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54faa38a-e6c9-4463-bc13-b999d9bfc2be.tmp
Size 27KB
SHA256 d7e8a6c8c36bb1360080d2191bc752f4b22b1d183f771e5ae5cb69add74822df
MD5 5204e96f4fa0bbf1d19402403a677c01
SHA1 6267f27da1bdb1aef4d0fda75f8838cf07e298e9
SHA512 834cd27ceabe615dffc8f06d207edac15e3e5b2705488310e3bc8076dda6667798406d8e8379e0254de78019bae182088c54367cb2e14e7c3553f7c7e1666897
SSDEEP 768:BhKlm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/2roQT:BhKlm7QWvUYm0u1ja8/L/E/NQT
TLSH
T172C2FB3B740CCB7E4FC04A9DDC5A6F976EA802C7A6588D404BFA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0177a2cfe0afc1c6cea8bba4af02edf1e6267be438a1068445e66cf3d8ca3c2b
MD5 f15943ef1dabf8af0b275b33dedbfc3a
SHA1 e7de2a92e75e2a7402ff188b4d91e6e2284fda77
SHA512 c728a01d51e7afae49528e684657e4a2065051b9134e244fbfdd200b5426aabb9a727c03f67c76b1b60a4586dd5d963828b8ad52f67b9f97b27071b1e2feb8af
TLSH
T126E026E816D8C33EF228A4A712AC434C8BE0771A97D0A90E1B44CA8975890C0B2C3AF0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 28ba3081463d8dbaacffb3a9ad0d9e089ef045f04239df0fdf5d408fed22b242
MD5 1ef16a55b70106e69c7614b4ea696833
SHA1 c62a8276d126de3f559046f537b5c46225101f9f
SHA512 3352db93899624f9f932bab3c47d0d41b0c5e2163f0900616c8548f2aa77c96362a927baaaaccd31916504adc60cd463d113f3e4f7a992fc8ca7726cd1e2c471
TLSH
T135617051BFD478A2FBA87FB9DFD714833AB3A7C00AA7EE419190D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 51e9496fed4d95c55787dda2904da2f9ca78c1d679aee1092f3ea5bedb58b5a2
MD5 5a31880688699a31aa563512e03c62f6
SHA1 b4432f97e39c2d1d73fac031e603728eee605749
SHA512 d6fcedc7370444e5ed2adf9ccd67f25cb96470051298400ad570bd169fa3e5f3cadc3b344e5ec3f182f3173efb7564219d1f578d925fd62ede5cbe1187630d5c
TLSH
T111618050BFC478A1FBA87FB9DFD714833AB3A7C01AA7ED41A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

5f2b6053-35a2-4f2c-bdfb-5073b6eb9f5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5f2b6053-35a2-4f2c-bdfb-5073b6eb9f5e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8876f422-9cf2-476f-9416-3b918ef33a98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8876f422-9cf2-476f-9416-3b918ef33a98.tmp
Size 1KB
SHA256 cf2b4f762de548c90bc2851330147768749e4853731ed52bf20cb988712fd03d
MD5 3642d17427ee1512b97854412e5d2105
SHA1 175ca5226b2ecc4976e719c33b5ebfacffe09cbe
SHA512 0a52db83aaf2c5df9ace6b174cad76590e7acd61b8e454ec7c399124ce5f8a2f556cb859a3f55c3dd84710498b4c63f632c84e212ef69efcf8234564fb05fdf1
TLSH
T1F841D1F7C2E9CAAEC80115F06A246D2BCE5E0529521C3C69C9D6EF4B93E3471E10168F
MD5 SHA1 SHA512 TLSH

Submit Download

a09ebea8-69ab-467d-93fa-eb197be2001b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a09ebea8-69ab-467d-93fa-eb197be2001b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c0b97a67-89dd-41e9-9b2b-18206397965c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c0b97a67-89dd-41e9-9b2b-18206397965c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d7026050-58a1-42fb-86ef-5fb05875fa1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7026050-58a1-42fb-86ef-5fb05875fa1d.tmp
Size 9KB
SHA256 6bf9c5be54518beaa2d2a89bd533ebd85a8ba68e43b5b0569e9ee80843e06c71
MD5 a1846dc8830e914e2ef387748171e3e1
SHA1 e015917906c7458e6be6ca1a3c26a3ddf18f99ac
SHA512 562c1a8823d1a99e621f2f2789acb801d4e7731b7390f9f063b23eed66c3257d43671c5acd2e47caf39b98151c3443bf04313134a47a80e4f0f69d4e041d6239
SSDEEP 192:sxZEj6RcWp/fURstHIdp1FSHW6+WN24I3/Y36nJOIIg5mJ:sxZpZp/fistInSHb2/XH8
TLSH
T18E22B752AE34697B4CCAD209BA25BF13D6F95432A1D51E58AAFCC61C05E77CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2372b6c5-cd54-479a-8a24-c78495658e3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2372b6c5-cd54-479a-8a24-c78495658e3b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a8569073-5e1f-4f96-8f09-67371baf9d00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a8569073-5e1f-4f96-8f09-67371baf9d00.tmp
Size 26KB
SHA256 ed471cb9f781b1c5375bd50ab7d31a5039d3d79ca184a4d3325741fdce23cb4f
MD5 fa326327bb403d4724984feeac31298d
SHA1 5599990d4f5bab0ec8800789e9a0f60cecff1d02
SHA512 96d29e2e9ad39d9ee6a1b58b7af5f0ab653250f074cf10e1e332d48daaddceaf8096c57f432b624be89b177e88c41edbbaeb6c013d0d16a02b23d07241cacb60
SSDEEP 384:jiFiZcISzsNx8TUNTUlIlyL9LDLb2TGSvh//z8ExUXQVJStgOIwZOyvEyHot:OFQ6wwgwW5/D8QVJSXsrWm
TLSH
T1B2C218F258D7887AE9AE5747B77E2E028E7CC067B5849A50B3D85A1CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9b2136e-b333-4775-9911-a596cc891a1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c9b2136e-b333-4775-9911-a596cc891a1b.tmp
Size 18KB
SHA256 5a4b9dc593b4983c947d385b6cc8b6b293d624c8ef0188388a13d583888e6574
MD5 367d447c85d971774bf78fab9de5884c
SHA1 edfe07e4832039d001893294a865d517ffd00f50
SHA512 8fec96639b224416a0610490d7e67e8ae444b349095dd5c7db9c729abbf579679f861d013d571116f03999d91b4013a5be9df390a4d9e24af793266035869bdb
SSDEEP 384:KZcIhsNPyL9LDLb2TGbvh//z8ExUXQ7JStgOIwZOyvEyHot:ohNH5/D8Q7JSXsrWm
TLSH
T1E2828C76AC799CBA29F7A144F58732038F748477A7C94F90D5EDAB2D01DA2981307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2f8a447-2860-45b1-b383-647bbb3d6b3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e2f8a447-2860-45b1-b383-647bbb3d6b3a.tmp
Size 8KB
SHA256 a24065cb7e8c570a7fc0d4f43f873fde0445de54a7b906fd09029185c6808f40
MD5 2f378805a19f44463bf204e424b2f303
SHA1 bd7c405bd415dc6dab37d54c114d61068fcdfaa6
SHA512 f33686b8838b01364fa4aae95e17c58bb7fc56c9753f88c2789916d3d73ad476f6cc3b06000441a059125596b73c022776c3e96bab6fdd8b26bc7be33455d96a
SSDEEP 192:BONy6JUHQmiUyw3Kto//jjzorB6ywxW5XQHNx+qNSU6:BONy6+pzato//z8ExUXQLJSU6
TLSH
T18A120A35BC69AC6B5EE3A585B04732139EA04137EB856F90D6EC2F2C01DB25C5306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0a0549e-9367-4bcc-ac21-b0f4a9c735ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f0a0549e-9367-4bcc-ac21-b0f4a9c735ee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f5a70cf72172a4a6f475ee81e4e9914a0f9c94de25375193e80de389c46def72
MD5 a718ed7c51aba65784804adad4dab897
SHA1 0d9fb1233e07e05e16d3726494cc443ee2634c7b
SHA512 cd4f4822d214615f34724aafce44c43f91194b93491db6d5fee7ad6663d6e78ebeace0169e477e549450b6d83a5ff4f96bbcaf383f25913ff0b7f351bfcec77f
TLSH
T1DB41075DA6FD1108B3B77E1AABF6A42D487BB9372A07D59D10110E4F0A22A40C9A1733
MD5 SHA1 SHA512 TLSH

Submit Download