a9ba6d60123bf415efe8869102ae3365766eb8f8903061e67a7faeb6e3031c30

Analysis

max time kernel
47s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paradoxfree.exe
Size 1.3MB
Sample260811-2prxeszyew
SHA256 a9ba6d60123bf415efe8869102ae3365766eb8f8903061e67a7faeb6e3031c30
MD5 6107241973fabb660b58386ed8addb6b
SHA1 a48651e9cbdcab2ee5386bbc20e0b77c8a7e6526
SHA512 03a9f47c005542b864c14eb3383c779ebdeb0dcd7a4c4f4d32ab624f12b8bcbad38dff878f7102d0b1d5a13ab50e2c4402dc7dc61eb9c97b71bbef8abb20c3c9
SSDEEP 24576:MphztR7vNOrEhWuemAo8UiCCnMxmKRlYMniMnFryc:KzPN2EhWNmAo8RC+gLRlYMnL
TLSH
T132559DD0BAE427B8C17F803A9696D647E5F7B840033099FF1398A5493B662D30BBB715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
108	3248	Paradoxfree.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\htuKYskKpGIvdqzpq\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\htuKYskKpGIvdqzpq"	kdmapper_240767515.exe

Executes dropped EXE 1 IoCs

pid	Process
4008	kdmapper_240767515.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
99	discord.com
108	raw.githubusercontent.com
109	discord.com
122	discord.com
1	raw.githubusercontent.com
28	discord.com
29	discord.com
36	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2200_86880240\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5704	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309619778546490"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{AC994460-DCF8-4AA8-8175-1BC0B2770AA8}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{5EF0E950-5F8C-4E8D-AFEB-5CB1D41A593D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	kdmapper_240767515.exe
4008	kdmapper_240767515.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4008	kdmapper_240767515.exe
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	kdmapper_240767515.exe
Token: SeLoadDriverPrivilege	4008	kdmapper_240767515.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2200	3248	Paradoxfree.exe	89
PID 3248 wrote to memory of 2484	3248	Paradoxfree.exe	90
PID 2200 wrote to memory of 5112	2200	msedge.exe	91
PID 2200 wrote to memory of 2592	2200	msedge.exe	92
PID 2200 wrote to memory of 5704	2200	msedge.exe	93
PID 2200 wrote to memory of 2592	2200	msedge.exe	92
PID 2200 wrote to memory of 2592	2200	msedge.exe	92
PID 2200 wrote to memory of 744	2200	msedge.exe	94
PID 2200 wrote to memory of 744	2200	msedge.exe	94
PID 2200 wrote to memory of 5140	2200	msedge.exe	96
PID 2200 wrote to memory of 5140	2200	msedge.exe	96
PID 2200 wrote to memory of 5140	2200	msedge.exe	96
PID 2200 wrote to memory of 5840	2200	msedge.exe	97
PID 2200 wrote to memory of 5840	2200	msedge.exe	97
PID 2200 wrote to memory of 5840	2200	msedge.exe	97
PID 2200 wrote to memory of 4188	2200	msedge.exe	98
PID 2200 wrote to memory of 4188	2200	msedge.exe	98
PID 2200 wrote to memory of 4188	2200	msedge.exe	98
PID 2200 wrote to memory of 4848	2200	msedge.exe	99
PID 2200 wrote to memory of 4848	2200	msedge.exe	99
PID 2200 wrote to memory of 4848	2200	msedge.exe	99
PID 2200 wrote to memory of 4528	2200	msedge.exe	100
PID 2200 wrote to memory of 4528	2200	msedge.exe	100
PID 2200 wrote to memory of 4528	2200	msedge.exe	100
PID 2200 wrote to memory of 1412	2200	msedge.exe	101
PID 2200 wrote to memory of 1412	2200	msedge.exe	101
PID 2200 wrote to memory of 1016	2200	msedge.exe	102
PID 2200 wrote to memory of 1016	2200	msedge.exe	102
PID 2200 wrote to memory of 1016	2200	msedge.exe	102
PID 2200 wrote to memory of 3792	2200	msedge.exe	104
PID 2200 wrote to memory of 3792	2200	msedge.exe	104
PID 2200 wrote to memory of 3792	2200	msedge.exe	104
PID 2200 wrote to memory of 2824	2200	msedge.exe	105
PID 2200 wrote to memory of 4836	2200	msedge.exe	106
PID 2200 wrote to memory of 2824	2200	msedge.exe	105
PID 2200 wrote to memory of 4836	2200	msedge.exe	106
PID 2200 wrote to memory of 4100	2200	msedge.exe	107
PID 2200 wrote to memory of 4100	2200	msedge.exe	107
PID 2200 wrote to memory of 4100	2200	msedge.exe	107
PID 2200 wrote to memory of 3460	2200	msedge.exe	110
PID 2200 wrote to memory of 5124	2200	msedge.exe	113
PID 2200 wrote to memory of 5124	2200	msedge.exe	113
PID 2200 wrote to memory of 3352	2200	msedge.exe	114
PID 2200 wrote to memory of 3352	2200	msedge.exe	114
PID 2200 wrote to memory of 5332	2200	msedge.exe	115
PID 2200 wrote to memory of 5332	2200	msedge.exe	115
PID 2200 wrote to memory of 4644	2200	msedge.exe	116
PID 2200 wrote to memory of 4644	2200	msedge.exe	116
PID 3248 wrote to memory of 4008	3248	Paradoxfree.exe	117
PID 2200 wrote to memory of 868	2200	msedge.exe	120
PID 2200 wrote to memory of 4596	2200	msedge.exe	121
PID 2200 wrote to memory of 796	2200	msedge.exe	122
PID 2200 wrote to memory of 2964	2200	msedge.exe	123
PID 2200 wrote to memory of 3596	2200	msedge.exe	124
PID 2200 wrote to memory of 3596	2200	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\Paradoxfree.exe
"C:\Users\Admin\AppData\Local\Temp\Paradoxfree.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/Qsrf86hzR9
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffe3064c188,0x7ffe3064c194,0x7ffe3064c1a0
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,10910687806325646643,14744665368314532646,262144 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,11462008838349015212,15016940238173952801,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,13805750583791670288,15156684254615488246,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,3912033389190951367,5868436753833099080,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,11932423995463122982,16819419415957033386,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,8224309895545800164,3137377581726082559,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4460,i,16340153968233717696,14534549168671600489,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,332536709705782986,4507233761961839939,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,7640910791290175643,13772908660769408697,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5664,i,3305507432387944048,11759054731025640748,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5924,i,15901772187743181262,6624503279717232689,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,6104304758148079942,7397321615542695898,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,7373978274978947797,14556837654045080377,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6600,i,3179150993935529239,2806903609595341944,2097152 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,3302376324540640999,2372259217752145785,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,3302376324540640999,2372259217752145785,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,4401663827906240106,14584116792567780298,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,12305245943839853042,5835077263947134852,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,522720664007774242,8872542877442247545,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,145767855922087935,12024168285400029289,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,3602219476518256277,12281672261669160886,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:14
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,4269074580071058507,3109144041865273422,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:14
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1452,i,3922526549619840042,14486412972627945151,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:14
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,1452891310245562063,8351600449526589680,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:14
    3⤵
    - Modifies registry class
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,18194663448220273671,7191827556174009409,524288 --field-trial-handle=2188,i,8384646589967891787,12871623407292366863,262144 --variations-seed-version --mojo-platform-channel-handle=1484 /prefetch:12
    3⤵
    PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/glockolex
  2⤵
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\kdmapper_240767515.exe
  "C:\Users\Admin\AppData\Local\Temp\kdmapper_240767515.exe" "C:\Users\Admin\AppData\Local\Temp\driver_240767515.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d998fdf55c9aff711202b75dc69db4237754318e3f70e8eed3b1409fc7d06279
MD5 c5ce860243afc4976c6a2b549b44b790
SHA1 979bb29ebe15fc318394ac4ea055a62231fd01ff
SHA512 ad65f7dc05728bcab49e7f4bb3cbc16e1608e04902f7d00e188b4dd58f2c0016cbf0fc1be2140e6d9a603ac9499418b6f0d3d85c96dfda81b8e05dbadb05d2ed
TLSH
T1ED713D8E83E707F1F759457185DE5B6CB2F1804A85072EE24B266EBC06C3F8096E2853
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a32e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a32e8.TMP
Size 2KB
SHA256 b3b6730d49cfefb3d07e7514fda291e3c43d4a010caba72c2335c26edc1c8b26
MD5 1888d9135a6b60d73903bdc22d3ec177
SHA1 1cd6a4dec06de420aa967007aa39faa471194ad0
SHA512 834fcab234eea8b7666c867a3480a00834a04a52f99745db4bad594bcae58a13661a9286b634d3b77d5751d2f0eb479f4808c403182f002a5388c4110d9281ac
TLSH
T1B851E64D43E70BF1F329457595EE576CB2F58499810B6EF14B2A6E380AC7F0090E2853
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d1e6f17ff310c44f0bcfceee9591044277a31f5f5f103d7d5169a4b88c2e338
MD5 435b76b55c9e4559c61950953f95cbcd
SHA1 b187f4ff9f8da8a9ea34eaf5909c8afd8d7c927b
SHA512 5bc610325a802d0d47333472085e51cedadfef32fc12c47d1f261688d58bf4321c2299e3ee0e350020ef0cf0890d82563166bd676bb917c9b6b1a6f3d391256a
SSDEEP 192:sxRiRoCB/fHmsTVD3AtxzoA8pyz/g6+WNpqSj1a/eBccZFLg4GXIgVmLJ:sxRitB/fHmsTVDLY/5BQ/eFqE
TLSH
T17B42C8566924AD3B5CCBD21DBB25BF53D2F95023A0D05E54BAFC9A1C04EB6DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3a8a0c54a97c7a53a2c0e6ebe0e45de95399f6964e183766019515bd460bee13
MD5 23b1931f59b85b164e349448d55aeb3b
SHA1 e456956f658bac46546ba2d7dabcbc7c15e7bcac
SHA512 4ad0d5ca51b628898f47b2b4090a215135a6f38139be9ad38d7d12524b004fee2ab6c5c962b5c7324c7b5380b18539e3463e43a2debb6ee0c0141599012d83f8
SSDEEP 192:sxR9RoCB/fHmsWVo8ZxjzoA8pyz/g6+WNpqSj1a/eBccZFLHx4GXIgDYP7QJ:sxR9tB/fHmsWVoCxSY/5BQ/eFZb
TLSH
T1CA42D75669246D3B6CCBD21CBB25BB53D2F99033A0905E58B7FC9A1C00EB6DD6203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 07abe62e0317be74827f77037ce29824e5b1816ec88131ccc6f5244cd5be6e45
MD5 4b24bafbeff5135e6e541b57a79582a4
SHA1 91f4afe61d9ace5dc863e53a1afbec98607cafc8
SHA512 f025025b5f1d02c8dc4b451dd42a4b76078bc6cdd671d8cddc52a8c10f07cecbba7bce0ce6f872d6c9a2089e75a3f9c3194fea767a39da12e93dbcc84fa4f62d
SSDEEP 192:sxR9RoCB/fHmsWVD3AtxzoA8pyz/g6+WNpqSj1a/eBccZFLYJ4GXIgDCmnJ:sxR9tB/fHmsWVDLY/5BQ/eFyt
TLSH
T1C142D8566924AD3B5CCBD21DBB65BB53D2F95033A0D05E58BAFC9A1C04EB6DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9696d51d5b4ddff96796b3ca3cd7460d5432e0d20157316db44e2554a764b651
MD5 e702791c1328d659e20d58984aff5544
SHA1 061dac4e3d57e819292e7f215606ce42c8b8736d
SHA512 a7300230423660996bc3613aff0c3a88fc41c5f8b6c892cf6da106bd37067ad40413805832a5cd037f1bf239de602b8f7a29955fcf11b4087ad59f49e0919b3f
SSDEEP 768:K80E+67pLuL7FwWgNhfRN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVwLWiroLu1FQ:K80E+SE7FwWgNhfRNu1jaigW5LufQ
TLSH
T16BC2D87B740DCB7E4F800ADDAC197E9B6DA802CB96D8CD8047FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 d63258da658b7810386fa9c6271c6625267ae9a022df285fac57bc04fe2f8145
MD5 ba53d446c0aa700bca024b54a471aa6a
SHA1 43e55fd1c39a1f91ee67053b16f1fa34577b1dc6
SHA512 38450cdeec66b0c70692e89d09b49ac85fd10987374d753187107eacdc1a68c9138644e775d04580a5a756de650cfad9d1844f8c8b983f2f080bd86490871cab
TLSH
T1C9D0A79BF5564440DB668FC2977251BA87622CC9244590CC9812341C34F9B969721F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a5bcd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a5bcd.TMP
Size 138B
SHA256 de4a29d5f318a3d9ef216cd11e3f22e8b88172e7f6534a062bfa244ee884e6e5
MD5 0c93b2e306da4ffec814c9ebb40e22df
SHA1 09899b547f94207ed7ec34e63feefe0977f97f40
SHA512 721f4966b7288d989a96447e234ceff6c31e71f9ac6314dd709b1291300fb27febbc3bd43a45d620592b1f4595f9e81e4d63ade5aefed8c1262e2053b98a8358
TLSH
T12DC08CABF2060002CB158A820222122D43022CC96882808CA02334181079F272102EE1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 49493321b939fdd188134eb2829fc6895ed900d80dbf31fd751a2917b5beff02
MD5 927e1894a39dcfc2ca8dde20063b3e30
SHA1 4a268510e1a8ccbdf1bffe4628f5cfd4b6fbe495
SHA512 f88b2ee2ebb5ef0ab8a50757c7a62cd56c297ffc6e435e480742781fc42267108c745d9c25953d469c0c0a60d52f90fef3898aac4c3300b5edabda292643c644
SSDEEP 768:grv+4UNbdH3oa+LeSFOU3S8X4fouOToPvB2thtA9VAwieVH1SlX:gbsbh3rCsnnwthttzEH1Y
TLSH
T1E003CF32A8A88933DDE6D398310B72573FF4815396D00FD499DD2B4D069B9DD430BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 63a66f953db55d508b401781019691eb774e6265275f895042a5d3ee202f61e0
MD5 b4784513c79bfc733694d850aaea8fec
SHA1 31b1390d10f05646bb2c43b17cdfc995d722ae3a
SHA512 aea56fbb1d907a9103a62bc49a5d7d00fb4286b67a87133e9c97f39a5680ba7eac916267e3f2ec0dff67c4c6b0a413cbec3e8d556cebe0ac404e94b969e2aece
SSDEEP 768:303UoW+s+LeSFOU3SfPX4fouOToPvB2thtA9VAgOPi9PetP:303UnffsnnwthttfPhtP
TLSH
T1DAF2C1B1A8A88D53EDE9D398720A33836FF45163F5C05F98AADD970D054365E0B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6bda53720c2849460da7eae0556ba8152c743a1435c1c48e18b3d13f876292af
MD5 25d566022675568cdfb2b5d9b8aae912
SHA1 d7a44315c4a60784d4c35b8fd3670dd007d7103a
SHA512 71952a5def227abe43efbd0935b1602dc63ad67f8f8ab3b8e62398dca8beff076704fcee7cea6450261f4c68320919c1f30c8aff887cd42272b34e4472eacccc
SSDEEP 768:Xrv+4UNbdH30h+LeSFOU3SfkX4fouOToPvB2thtA9VAgOeVH1Slo:Xbsbh3qfqsnnwthttfEH1b
TLSH
T1E603BE7298A88D33EDE6D398710B72976FF4506394800F94D9DA5B4D0A476DE1B0FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8691eca854f17a4fcf000055be7418344b17ee5cc4eefc351e5c4221fea3e651
MD5 e63c8a454d8f2418cdb739b2d15e1a6c
SHA1 84c5243f783e3381b8fa08018075eaf386d760b1
SHA512 44b033529572f1d27af3d8531e10b4bb8bef20986983bb86fdfb8c9ce82b3e64cf203a367d72085dfb36f764b32946fde9419249dbcf4e574238bae439614ca1
SSDEEP 768:Wrv+4UNbdH3Gb+LeSFOU3SfkX4fouOToPvB2thtA9VABOeVH1SlX:Wbsbh3ifqsnnwthttQEH1Y
TLSH
T1DE03CF7298AC8933EDE6D398710B72973FF4506395800F94D9D95B4D0A476DE1B0FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2dafa6e9e5958a1c5d4f984446b06720c15605a3dffbf24810d7f5380cbc2833
MD5 c4d43266c7915b48bac1870d1f5feedf
SHA1 5ee3f2c1ac7b509818accbc19d2f60cde6d86ff2
SHA512 df91286fe17781515d83680162e29029c1f6c3bec25e0108396efda08ce2797313cda2aeabd9c55488763d77f14368e37be0fad084474faf8a6378a1b6524812
SSDEEP 768:zrv+4UNbdH35oK+s+LeSFOU3Sf+X4fouOToPvB2thtA9VAgOu:zbsbh359fksnnwthttfu
TLSH
T14C03BE72A8AC8D33DDE6D288710A72936FF45063A5C00F98EEDA5B4D09476DE1B0FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f47d60ec5a24c0699c32bbcbe0c8b5b22a87cba08fd561cde8070a2b60e92bde
MD5 2e948e8d0feb219e81cf12d26ebb2943
SHA1 79a8a96ce6ddb0461ed4c9ea39d5c379198b359c
SHA512 cb90627d10393a86fa69a9598fe5b12fae6fd525ef5c6deb6dc47b8c919968f32b55d46c1f637e400d9a2de807452287d8357422a1772949ec898d8d9f8eda0f
SSDEEP 768:p035oW+s+LeSFOU3SfPX4fouOToPvB2thtA9VAgOPi9PetP:p035nffsnnwthttfPhtP
TLSH
T10AF2C1B1A8A88D53EDE9D398720E33836FF05163F5C05F88AADD970D054365E0B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 85ba432752390ded420363509905d9db8b7fbdd42dbd33d5242a0a29e3c93d0d
MD5 4b245bb3521d931d3477a10dea504e28
SHA1 68ed5daa95bcc8a3e39eb2f81611b7bc85aeb2a3
SHA512 39dae31c8344cebef699037e67977d19df49a20db737fd379817a6a99dee50b21b54d3964caefa1a0a3c06bbc304dd466c382c11e5e2cc712d313b4932bac946
SSDEEP 768:/rv+4UNbdH3XoK+s+LeSFOU3SfPX4fouOToPvB2thtA9VAgOu:/bsbh3X9ffsnnwthttfu
TLSH
T14B03BE71A8AC8D33DDE6D298710A72936FF450A395C00F98EADA5B4D09476DE1B0FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b370bd0c-ab20-4d33-b386-c19f8a7ec3a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b370bd0c-ab20-4d33-b386-c19f8a7ec3a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

dc1fefe7-6f1d-4d15-8130-0f769bdae372.tmp

Path C:\Users\Admin\AppData\Local\Temp\dc1fefe7-6f1d-4d15-8130-0f769bdae372.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

kdmapper_240767515.exe

Path C:\Users\Admin\AppData\Local\Temp\kdmapper_240767515.exe
Size 399KB
SHA256 5ad190b991c21a299927f682fb008aa7bc3c0189b8c758fb4a22613dbcdf4e84
MD5 67c7f1e926cadd64de19373474fc6e51
SHA1 9d1a980ce74a4717daa66b7a4bc449649a810d6d
SHA512 98f9282cd50fa67fb01d53a864b407fe50b441c2a9cfe99cc04972481fbe6d65dcacc84c9e0e54266e5082984db16c8fe61c7e559a7e95a6e749b61800bb29a3
SSDEEP 6144:Yov/ih7aY6C5mD33nqklhAd2DW1+hFVbgBTi7SrRWlhZpLkClU:YHh7aEY9Ax+/VbgBMSrcPZpLxU
TLSH
T113946D55F7A404F9E2B7D178C9724902DAB27C590770E6CF13A8099A1F23BD49E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2200_1506905233\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download