80447b8938f340fbc576893d347245f841b1baacf2f75f32b8730fae7f4c1a13

Resubmissions

23/08/2026, 12:49

260823-p2kyesxame

23/08/2026, 12:44

260823-pys5maxakc8

Analysis

user interaction
yes
max time kernel
42s
max time network
42s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Testing.exe
Size 1.2MB
Sample260823-pys5maxakc
SHA256 80447b8938f340fbc576893d347245f841b1baacf2f75f32b8730fae7f4c1a13
MD5 272339c02f3d7911fa6c4459d0f1fa55
SHA1 cfd5d4a325a97f88e88bbd5d85335865f94d3007
SHA512 dd92f798b941a0499e9352f1c1d5cd37eaf0a5c97e19bac32a7d0d3881e387e820ab78884f3521dae42897ca77f630cbd944888c5218bfd188797c53ba9293fe
SSDEEP 24576:yH3zvDWw5xr6bTKYNiO2Cu9q+U3DFRMHaNNibnFD2U:Qzj5YbTKHgJzFRBcbn
TLSH
T197559DD0BAB826F8D07F803A869AD547E5F67840033099FF139CA5593B662D30BBB715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3592	Testing.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\acpiwzzenum\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\acpiwzzenum"	kdmapper_240655609.exe

Executes dropped EXE 1 IoCs

pid	Process
4908	kdmapper_240655609.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com
35	discord.com
36	discord.com
40	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	kdmapper_240655609.exe
4908	kdmapper_240655609.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4908	kdmapper_240655609.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	kdmapper_240655609.exe
Token: SeLoadDriverPrivilege	4908	kdmapper_240655609.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1620	3592	Testing.exe	83
PID 3592 wrote to memory of 3816	3592	Testing.exe	84
PID 3816 wrote to memory of 4900	3816	msedge.exe	85
PID 3816 wrote to memory of 4356	3816	msedge.exe	86
PID 3816 wrote to memory of 4260	3816	msedge.exe	87
PID 3816 wrote to memory of 4260	3816	msedge.exe	87
PID 3816 wrote to memory of 4260	3816	msedge.exe	87
PID 3816 wrote to memory of 4704	3816	msedge.exe	88
PID 3816 wrote to memory of 4704	3816	msedge.exe	88
PID 3816 wrote to memory of 1848	3816	msedge.exe	89
PID 3816 wrote to memory of 696	3816	msedge.exe	90
PID 3816 wrote to memory of 1848	3816	msedge.exe	89
PID 3816 wrote to memory of 1848	3816	msedge.exe	89
PID 3816 wrote to memory of 696	3816	msedge.exe	90
PID 3816 wrote to memory of 696	3816	msedge.exe	90
PID 3816 wrote to memory of 1396	3816	msedge.exe	92
PID 3816 wrote to memory of 1560	3816	msedge.exe	93
PID 3816 wrote to memory of 1396	3816	msedge.exe	92
PID 3816 wrote to memory of 1396	3816	msedge.exe	92
PID 3816 wrote to memory of 1560	3816	msedge.exe	93
PID 3816 wrote to memory of 1560	3816	msedge.exe	93
PID 3816 wrote to memory of 3208	3816	msedge.exe	94
PID 3816 wrote to memory of 3208	3816	msedge.exe	94
PID 3816 wrote to memory of 3208	3816	msedge.exe	94
PID 3592 wrote to memory of 4908	3592	Testing.exe	100

C:\Users\Admin\AppData\Local\Temp\Testing.exe
"C:\Users\Admin\AppData\Local\Temp\Testing.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/Qsrf86hzR9
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/glockolex
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffd1460c188,0x7ffd1460c194,0x7ffd1460c1a0
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,15215876157351776646,5119363320815848130,524288 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,5521776724784008765,18233879634271335,262144 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,2311975620005890047,15603247261148329330,524288 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,2915554957559022951,5799971541484444732,2097152 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17813498638466029933,15763359384495863317,2097152 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,8482164889599432563,3203510460094151558,2097152 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9059720929615385910,3428493714381243170,2097152 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4448,i,4221919527486859341,6306467404509779454,2097152 --field-trial-handle=2352,i,4905287321667309415,4784118470241265745,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:3208
- C:\Users\Admin\AppData\Local\Temp\kdmapper_240655609.exe
  "C:\Users\Admin\AppData\Local\Temp\kdmapper_240655609.exe" "C:\Users\Admin\AppData\Local\Temp\driver_240655609.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b3178e8311c1224bd5263b82833e7c8699a98f41d45776e848151afac5abb36
MD5 1fac945bc89680f07a15e92caaef80f7
SHA1 99229fa92d8dd9904617715cf7e0973fcf13d02f
SHA512 173d53253ca2ea3355e730566ca758de046be86edd2f2d9e216bfc24d1f8ee6296af697837270c38c689474249a311926198240e82513fe87a1fb4ec6d62e944
TLSH
T1B5D0A723696D7491F77D1278A912CB00173955B225468301F200C89CCA740D962D6EC7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fbf808f69a28d145699176ae432abb9de89171f1e45e41eef0f4b424e41f00e7
MD5 3b8c8329f9d6eecb06b79ca49637983c
SHA1 bcde82ff68ea711a8db0fe39251ee85f4cde8506
SHA512 b5d10e792f97b95c089fb8f88853dee000318b5f2e2d68fdbb277714f6c8e69ce23fc15adccf03114b254ce0811daa580b05aa34755b2e066554c341291e8dda
TLSH
T1EC61C207CB1208A2EBD82033A8F1E708B5B1819849CBEECF7563C5F417373E1C156988
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 974B
SHA256 4411557a406250834d529ac661193cdd89677f9c2e97f428831b7b20e75fae56
MD5 d0ebf1668b4b1992aebb324809ed72e6
SHA1 d0889eb1cd9126960fb3b5d7ad565493535116e6
SHA512 bbb32edbc711d6f5ee38b4acca63c41728f8f887076a7dc1a5df0f07b306ccbb22f1056ce4ff26757ebaa873a00972b8894970472ee7070cfa7ddeabb10f5221
TLSH
T1BF115EF787A48A7E8B0192F49A146E2BCF1C0915431C7C2AC5D46E1B97B35A6F04194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 896433e3adc83e5c60cf871f50e439bca97920056fd4e103116a40713a1eb0df
MD5 c57a03c428b8fd0b29fde1fcf1094d20
SHA1 0a2712a4f441227327c039743e3bc6433c75a43f
SHA512 d7e352f0ccab4dc541c26fd45b0d6fbc0970027a826ad962d88c32657add6318cee2bc70fe0f7eb048750e4fc5cbb577bef7d7c3a1a5028efdd6dca0fde79d10
SSDEEP 192:sxZFRNVyM/jK1Ml8jj7/ftsMWpVVqQSEdpMHW6+WNGYcD7MjIgEJ:sxZFHG7/ftsMWvVqkMHbGcI
TLSH
T19542E801AA34997BCCCBD20DFA557F53D6F90563A2940E44A9FCDA1C01E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 86639147b151761321a9c4061ab187c4e794c4e6defeff71fc6d38365d87c9bd
MD5 e15ccd40e14e2f27d58d05949e22506f
SHA1 f76847516285ceca0af6212e8460a6aedcacbbf4
SHA512 1d1051357e45d13fe95128c40f8f606f01ffa0d367d46bd9c7975c7f6500ab07893c81a8888f1e6e3739597344c13bc8a0599dfdb49103ff4786eb91493dcd12
SSDEEP 768:1M4RkXUWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlLBEREroDMQ4cfup:1M4RkXUWvssLgu1jacTLBWRPIt/p
TLSH
T1DED21B2B284CCB7E4F845E9CEC26AF966ED802CB97644D4447FA844C03C77EA511B9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 6c724fcf5df64156cf78412e8ccc8667e10610b4c8e0a87d172865c1162170a9
MD5 0f64e97aef15a020cd67f567327eb6e5
SHA1 dc89b6dde09ea8042394878b628e9dcf12e373ea
SHA512 c7e171f5e2f650552dd356742788a2fe8e93a8b6ed00b8e42955ab6896506c3c98a01f0922c5a0eeef7646d95e6dc7ef207f6d7975a8c80ba8d4625fa62b0451
SSDEEP 384:zvsN81j+i1HdQ4sw2T66evemcl/G49mkgWXy:jR19o66aet/j9oWXy
TLSH
T1F082183DEC246C3F48AEB708664E29275DB45237D6B85A58E3D81B0CC1BA58CF307966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0a6796384c4cd673b7863b095b26c88b31b19e781ce492cf26208fbfff9fc93
MD5 0946ac149a61c78ccf27a8e8a72debae
SHA1 efdf42e36384b2b5e7e7b2c531ea45d1e8908265
SHA512 4371b14409db0c390b8b513c68122ddcf0fe55dafde669101f4c5c6da5a1c004352691efbad8bc08ef1150812f969e7796e9dee59cb885c89376e491dce7103e
SSDEEP 192:lONW6JpdQmiUy1ZgcQ4sw2T6V8fK4sFHWdU6:lONW6jugcQ4sw2T6kk6U6
TLSH
T1F302C835AC787C7B9EF3AE45F5872B236FA4117BE6946B44DAE81A0C40DB24C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 633e5072696d31cb5667b80df2a10971ba9b1b4caa4e943fd6d8e30114f473bd
MD5 bc0323abc57cb5c7972524d0ca4eabce
SHA1 232b2c60c3822b409fe206472a1bf48203211f52
SHA512 754d4028c08362f2488eec51fed6627c95fac5bc8564aa09186dd25036b18b82586055b838ac7819477f9b4d4687a88eafc6b56faccb7f5ed15fa8e69237311a
SSDEEP 192:zjON86Jp4Nh+QmiU1eWbZdQ4sw2T6V8fKueTeeIshBUqhqHU9:zjON86weFFdQ4sw2T66eKeOHU9
TLSH
T18222E734A878BC7B5DE3B515F9873B639EA41173A9846F04EAD81A0C00DB38C230B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5576acbeb352007e91ea88c6b88d9e64ac64af9d6fbe53e5b22505edf23f7286
MD5 023657c03036da0c25cc511c01d52feb
SHA1 48da9796d4615719f0d56070fe6298a9aaa74873
SHA512 5f3552365dd6e3e4472fd106bd3d6f9a0eb7268d02ad5cad9df0cf6d976a022709f1c4fc87181f9ab4fc5be8d7ab272e0d0773fd42e3ad548e5bb841c15f3b3b
SSDEEP 192:qONF6JpsQmiUyjZEcQ4sw2T6V8fKueTeeIshsUqhqHU6:qONF6kGEcQ4sw2T66eK7OHU6
TLSH
T1E412D975A878BC6B1EE3B515B5873A239EA41273DD84AF44E6D85A0C40DB38C270F936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b335cda4-4519-4604-bcd8-362743102d45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b335cda4-4519-4604-bcd8-362743102d45.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

kdmapper_240655609.exe

Path C:\Users\Admin\AppData\Local\Temp\kdmapper_240655609.exe
Size 138KB
SHA256 57832f7a25c5cd0dfca09c54d0019e4f19a0d27a949a92dc68baf35b72be8211
MD5 365fc713b2097470bd269602b5d54eb2
SHA1 4e237fb146ed252246ad81231294f877edbc35c7
SHA512 5033693df40f39a568967b26977603c353d59e538d43da430838875d5955181cc5533a3ae8de4aaf23b8841046e72f970f539879f44c17a633b72df08ead29d3
SSDEEP 3072:ejVYisyVqzOSDMbfVP+qmJTQSaMm5/6Ygnzg+zOG:ebsyVqzOswfUWlBgns+q
TLSH
T112D35B2BE659207ED2A6D9BDCA524912FBB27C850751B7CF136049B60F627D06F3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download