hxxps://archive[.]org/download/windows-loader_202409/Windows%20Loader[.]iso

Analysis

user interaction
yes
max time kernel
36s
max time network
36s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/04/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/download/windows-loader_202409/Windows%20Loader.iso
Sample260418-hmfxlabw4j

Score

7^/10

discovery persistence ransomware upx

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Windows Loader1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Windows Loader1.exe

Executes dropped EXE 1 IoCs

pid	Process
3124	Windows Loader1.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msedge.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00100000000284cb-475.dat	upx
behavioral1/memory/3124-485-0x0000000000400000-0x0000000000623000-memory.dmp	upx
behavioral1/memory/3124-576-0x0000000000400000-0x0000000000623000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Loader1.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3788	msedge.exe
1188	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Windows Loader1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Windows Loader1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209686750283756"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3431708735-1789331158-1295227519-1000\{E635A63B-5CB5-4494-883C-BDF69A64948B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3431708735-1789331158-1295227519-1000\{1377AE0F-5977-4F29-9377-88FDC2DE42C7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	Windows Loader1.exe
3124	Windows Loader1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3088	msedge.exe
Token: SeManageVolumePrivilege	3088	msedge.exe
Token: 33	3124	Windows Loader1.exe
Token: SeIncBasePriorityPrivilege	3124	Windows Loader1.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3124	Windows Loader1.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4036	3088	msedge.exe	82
PID 3088 wrote to memory of 3788	3088	msedge.exe	83
PID 3088 wrote to memory of 6084	3088	msedge.exe	84
PID 3088 wrote to memory of 6084	3088	msedge.exe	84
PID 3088 wrote to memory of 6084	3088	msedge.exe	84
PID 3088 wrote to memory of 5336	3088	msedge.exe	85
PID 3088 wrote to memory of 5336	3088	msedge.exe	85
PID 3088 wrote to memory of 2052	3088	msedge.exe	87
PID 3088 wrote to memory of 2052	3088	msedge.exe	87
PID 3088 wrote to memory of 2052	3088	msedge.exe	87
PID 3088 wrote to memory of 6028	3088	msedge.exe	88
PID 3088 wrote to memory of 6028	3088	msedge.exe	88
PID 3088 wrote to memory of 6028	3088	msedge.exe	88
PID 3088 wrote to memory of 2300	3088	msedge.exe	92
PID 3088 wrote to memory of 4404	3088	msedge.exe	93
PID 3088 wrote to memory of 2300	3088	msedge.exe	92
PID 3088 wrote to memory of 4404	3088	msedge.exe	93
PID 3088 wrote to memory of 3848	3088	msedge.exe	94
PID 3088 wrote to memory of 2572	3088	msedge.exe	95
PID 3088 wrote to memory of 3848	3088	msedge.exe	94
PID 3088 wrote to memory of 3848	3088	msedge.exe	94
PID 3088 wrote to memory of 2572	3088	msedge.exe	95
PID 3088 wrote to memory of 5036	3088	msedge.exe	97
PID 3088 wrote to memory of 5928	3088	msedge.exe	98
PID 3088 wrote to memory of 3836	3088	msedge.exe	111
PID 3836 wrote to memory of 3400	3836	msedge.exe	112
PID 3836 wrote to memory of 1188	3836	msedge.exe	113
PID 3836 wrote to memory of 4044	3836	msedge.exe	114
PID 3836 wrote to memory of 4044	3836	msedge.exe	114
PID 3836 wrote to memory of 4044	3836	msedge.exe	114
PID 3836 wrote to memory of 2360	3836	msedge.exe	115
PID 3836 wrote to memory of 2360	3836	msedge.exe	115
PID 3836 wrote to memory of 3320	3836	msedge.exe	118
PID 5164 wrote to memory of 3124	5164	Windows Loader.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/download/windows-loader_202409/Windows%20Loader.iso
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff81a8cc188,0x7ff81a8cc194,0x7ff81a8cc1a0
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,9580192232781613887,9255898413203054077,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,10502073030254559462,17246500350373262809,262144 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,14804478281097150383,15420894614978209940,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,1909284715664129420,470595857275811584,2097152 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,11946473685681583429,12815951933349155266,2097152 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,5345175973563818832,7787236232972343770,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,11077114107228900516,13371491733582354582,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5568,i,16479093635761456507,8414978259125889796,2097152 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,505140579109863275,7712243776863654607,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,18204184294010869560,6271145718234486957,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,18204184294010869560,6271145718234486957,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,15781132718417630651,6840422382969638773,524288 --field-trial-handle=2288,i,12237196107327665628,14615144474491481283,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff81a8cc188,0x7ff81a8cc194,0x7ff81a8cc1a0
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,11615416719099274780,5026144891948188298,524288 --field-trial-handle=2264,i,822985385908853631,9664967417581902980,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,7122774205013154739,874287807235928541,262144 --field-trial-handle=2264,i,822985385908853631,9664967417581902980,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,10275297187031504069,6778144198237403748,524288 --field-trial-handle=2264,i,822985385908853631,9664967417581902980,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:8
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,3397587384822523835,14863960278149849774,524288 --field-trial-handle=2264,i,822985385908853631,9664967417581902980,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,3397587384822523835,14863960278149849774,524288 --field-trial-handle=2264,i,822985385908853631,9664967417581902980,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
    3⤵
    PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:380

C:\Users\Admin\Desktop\Windows Loader.exe
"C:\Users\Admin\Desktop\Windows Loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Users\Admin\Desktop\Windows Loader1.exe
  "C:\Users\Admin\Desktop\Windows Loader1.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b680380082c2d624f7c1347036ec0f1a35a823957bb3a3a093268eafbd929c52
MD5 c8209eecc869e6de22a06121bb50f282
SHA1 23420471a9613f47128b01b562c6289aa841d54f
SHA512 0a9325b0715dde4648cfb4be0743c027565f4fc48bfa4986d6d3bfaf58299bb27ddca3ab1ef2b84ea2d985c2378e4d6399550b134d4aabc234e1eed29965aa05
TLSH
T1AAD0237439AEF015D53C053311516152D78FC50124D38141F156C05CD478269DFD68D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46a1eae1fecf49acea451f3862de92bfc0d04347c31f337b1b20a824533a9b1c
MD5 3ca03739e43181be3a6da5f571d6f1e3
SHA1 8ee43e5325a4a3c85db7e0948d192c9c87f085a7
SHA512 7e01203f6dd40073e0305c84a1263a649f8dd249a11bfd12f4df6b961cef416b883269f4cf95f551345131a19eab3fc4c54071a430a10502605397e92336da62
TLSH
T11DD0808C11767C30D4ED4B7114467707A55EC4624883931334A365780C530009DD74F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 513a725ead86a5f091170815d9443bdfe930a54575da78ac401e7b1755d5dc57
MD5 19fbff336f39740400202f533cf8c1e9
SHA1 d557c0c989cdbd056dfc335be5efa47c4a273154
SHA512 ba31ef36c233f3a5a3117b971f1cca4818764f19c14ee00638abafc913686350ed3e8199edbacd866a57b29ca483a89c0412861eccb6b5b327458dfc3da330dd
TLSH
T15AD02378341D7000CD3C133350C0B18197CF481011B241C330D5C02CDC05560DBCE8D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf7fef5b641ffdb161504815f995ee61f9439d3c4537963a8df2f874ef1d3c87
MD5 e0fdb34aed6cd117d0d4bbde4cb33eb2
SHA1 ac6b65b9e2f74553ef5169aeadeaa0253e49ea7e
SHA512 200ba3ad674aae0fb0cc899c617dd69378be2aae99a8f7c069619c47a65bf7042efb437daa1683e824157ccb9e327dcab88cb95e97f881c46c9441b8b4e0693c
TLSH
T179D02374341D6000CD2C133350C0B18197CF441011B241C330D5C02CFC04570DBCE8D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec880f0c5279dcee4c2fa0d92e3dd0f94953916823358924550a9c39702b8d09
MD5 747ebacd4f00d16c2abddca6ebd0e94a
SHA1 8d034cb8b72a8b538f1887c75df30e286c9dfccc
SHA512 f81a74e31a96fc04ecd4d77ffba9f164d92dddde62237198692f964f981a54c84e58a1152235a3c590b4035593bc5ac57ea6adc4df258eaa354b647f174ddb76
TLSH
T1C2D0808815726C30D4DD4B7114867707B65EC4624883931334E365780C930009DD74F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 39857a28ba6543852489761e8e06d83d60a9ade90ccfb1d8b6fc4e6cdcd00031
MD5 cc98fc7db29c46db3856536298a86c75
SHA1 d1a31dfcb5e418629c8fea96b7d4b547e0b98a11
SHA512 e2fe71dbac30a310af27cde4e90f5680b82abed93656b89e3551375b1fe9468e6b0a2f70020ccc489458efe3ded5274e10526312899454bfba8de6a4acaa2154
TLSH
T1CEE02BABCC61AC2B09FD075D61954755E65123573B50596F3F3C820D8FB073B4155C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ff2e5f15c89f39e7a88bf80573ea565af73b8c7e60910b7151a3413dc3ca0ad9
MD5 e9631c49fd5d7a45fe752736ad436bdc
SHA1 a8d100fd1dc0cf760abb867aadbcee77fecfeb9e
SHA512 dcf8ff4a65f79fe485d9fa1aeb05a9e535321fc293ace089dd6b81e78e725a1d7f9c92a2aa1064df97ef9215bcc620d4d986bf19bb9b9d113871b3ef44ab74e9
SSDEEP 384:MDOcLfPWGXdsl4fCp7+XiE9/ZOkM7icT/Zj:SOcLfPNdsifjXv9/ZOr7iSZj
TLSH
T196138E3EB31D8D63E6C600BF8D5B1B72A334E860E9D012175325776C46BA3BA395E132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 23bd685c3dcc2d298a88335480a7347124cf03613af8397fa2961a1efae75081
MD5 e0138343d6ecbc20a3f59306ebbe062b
SHA1 192e9e45a20f672facce58522511999c85f3c650
SHA512 f94b7c72155431831b33e74e09763393c78f8d3a5bfcbbfcd1927ff9358bea554d56e44c1d9348d23219c46fa63a52ca4cb8eac07c146358a077ba8b14be4333
SSDEEP 1536:u3kHzn8J+uCn+dFTuiZvKsi9fs0UZOKuKapl7Yi56mfAb/rcAJiZI:uG0DTefJZkmfa/JJi
TLSH
T1CE445FF70955A02BCFA802F6D2133A3DD177405D2CE1F8E9D63C0C952826B32B6BDA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 f37937775886716b71cdd1f857b11f2fe1c4577febd56889ba3ff78056fbf439
MD5 82aaef6da35d0820b1cd4f99a0b240d2
SHA1 63b60d66756decdbc7b86c2871939b1d2b4234b2
SHA512 8d8cef0105e1d545a011a9dfe630fa0533f3df5dcd61d30f7c9dc06baec6754b4b54603d121a05a07daaa012fe4b1c8229195c9a54b084601e52615f920ff8ab
SSDEEP 3072:Lr5mJNSiHmGzFzADLyHbW+2MI49isQBl87iyrZR:/5GSJGzpIibWVMI49isQ/QNZ
TLSH
T1EF255BEE8B382C87DD6B4D70B4E0EC22BCB412D3751AE1D34818C990975A3C6679B5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 d4768b00b05175ad49b09359dff8b1246af2e21a0e9cb16b7c0476bec3caa033
MD5 c1dafd333ab5a84d770c86739a19f6d4
SHA1 602e39aca995e12c224b39d7ec72b9888cfbf9a2
SHA512 10d6fa43625e3fe645883b631a859a060562c7365bc1b0b38f28609555f2bb55dcff5dcb800e1e6cfe118841574dd9ac3607a4c6933872e8493ebc225189d7cd
SSDEEP 24576:e/Wg6aJ6N9UjHPsNT+tq4DyLi9e9f8ejPzTX/p/AvXFJvw1/uS5ZBECkUeb+GoA3:kP42jHkz4DyLMXeHTNIVZoHZUbfdCm
TLSH
T17F867EEEC6785C83CE679A70B4E0EC477C7412C3F555C1D38958C69802A77C1BAEA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b1171d46c6dc914653fba08c34aaab4dcc8c6364e82681e6788e8d20256385cd
MD5 758c11f0d8209b30ad4dc9598316d933
SHA1 a9d7f7cab648ae1393cc1efe49406d63b8814f93
SHA512 d1ab028479aef21699cc569c4bb9ea5de825940aaaf62b1da9c9920267b4930bf9cc2481213b39374e39644639a6f7a0d1b3fcf0a0cce34856b345b174b8262f
TLSH
T15A713D04038585AAF3E743B15ADB917B72F095A4CD9FDE1606D353BE5A26F334146133
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 267220bab452ae830382d1131a01612309e250c7a7ae13e2673d0a031b63d20e
MD5 f7fe61675442d539424b943d6b2065d0
SHA1 c88e58f6499bcd4487c0b72f90537fb58e553510
SHA512 073d65dd4185918d74370c87d329eaf6379543df9fba6765c88688d4cfe370da723fafb41e68db534f3c5eb8706ab81360eaa6b89ec2151685ef342d6a0efa08
TLSH
T1C3E0D89669CBC56D559839C39138AB0EC2813486D69D6D031740CDC47E07521F661A46
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 a81221b14787884d7c606bc571e34f0b83c06c3257e29ff868bbce409ecd730a
MD5 7b24841fd0be49d61cc4402b5f206a3e
SHA1 5db6da036fe0a65f40ceaefbeb47e8236993373b
SHA512 cadc4cacbf7e6636cbf14fcd9bf7af22d718e0ce4ee9d2e9d8d6b4bfbd3bc1155afafd93952281d93e290ddcef01af48c3d10adbf87760c85301541371da13bb
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jIE38W5L+EF/K5fKFtIaqYp1:Tyi+7f+UZD4jJ/B0E38Wx+ElCKFOaTp1
TLSH
T1E0E2CE8D3B11F921C4ED733DA0C2C5F05EFC696C4A5D71B1523898728C536A2F49F28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 72941738aba058ff7d9b8b97e2d16305e7a238f5728ea2e339a5327cc1195355
MD5 82dcda387d37632153f5eeda7354c221
SHA1 670d38195d30ba3a1083df5e95fd3a4a38173d05
SHA512 9f2649c6de20d3472f3a99884cba6857e8213ef59e33f7aabf81932684d78a4111ba336a76b08b06b0e9f44996accdd9f9b7bbce268f4a1e090faa29d2d5a611
TLSH
T190E0268419C8C97D955C7FB3826CB709C2E034CAB28A3902178E9844B141B41F2A72C4
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 798f90572b57cc84ba31aeeb18f4d75b401109cb6dba6a1abfc586cefef8d672
MD5 4155da34daad22484f7b90653bd4d4cc
SHA1 1439048dae10646b58acd4cdfb2803607629c315
SHA512 a4c37659ed3071fe791a7f4f5a966e125a7c70d9db61628f199cb5225de77bbc57c1e84dd7a8b3079ce0fbbfd73148348f6996a463857cf074419df30ac5ec3c
SSDEEP 96:nGlDX/IU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+H:nMrf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T12F14110E5F242721CDBD917669EB44B35D7CF03F8B5366DA687104B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 63908bce87bad2084678a273abd3a1d1b66c5e6e80a512be6a98f3ca16f379e2
MD5 663741433a39fc22b9d00a6a49c14da1
SHA1 f2b16a133d179d7744aa7068c65b69897e6dfcd1
SHA512 1c22641c89b69b4c1d7e79707d3d16042371af1875122dab438f1ef611ddf959566b32208ba3f4cfa427bc140c0b21073e9a821cdc9a922a52047ebac47464c5
TLSH
T1B3E020A159EDC97D51C83557421CFF0DC7B0348BE69C3E015B44AD47B041904B39B3C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 fae108ebd92a8150db8e23e1eb5fcdb7090bd484119cd00a5da8cd17d0f2b5f3
MD5 edfc35b03b7dbac2c0cbbaa7f2dc97b5
SHA1 867ae17ff07927a5e42dfe330d7f27060a3bd392
SHA512 a3fe8f30cdfebafcd19970f61c0461dfbcc9ca068dfa07b70bce7c414005848aeca15e9daa385ecd2fef5cefd703f00565f422b5db3e571fd5da0d7cc8e4d0fe
SSDEEP 48:T2SLopFMatSaw/auUOt8Byo1ewYxZ8ZVHTAwH:iSeMatUaAK1efxZI1TAA
TLSH
T1D392010E5F346221D0B04B76EDD086662F7C201DD363359DAE0460F3DDA258BF5061AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f21dc1aae81fce7058cc4bacbc520f8e45fe8a338379b02bbbb71387dc112119
MD5 541929b0f79fb255107b36b55abe20cf
SHA1 575c3f1638c0534d76ee32d47a431f00d200a607
SHA512 d7e2a19cb50a7980741b98b2a312d54efb47927939cc8a4c9dac70bb043847f398807d5d409f2d5a745f20afc3d5a016de15ff6a70b28b626e9cee082b71d215
TLSH
T1C041C1F783F4856DDA1196F0AB18AE1FCE1D0514432C3D6985E0AF1B93E3471E04165B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 228871d6a6ae18e6ddc078c1a0dfdce213deab523ce538e22905ee638a02562d
MD5 7cc9e6f98baa2039376e290058320889
SHA1 f3ba8ef0f55d503369a492b958030a615ed4e4b6
SHA512 3701c74ed088fb7e80d2a710a0f5a036d359f3bc2deabfe56527cb4182f16c2c9f21cb5941ad3056e9ff290222468c1ea7ae65f9e7aa026faf9a55c2fc8a7eb9
SSDEEP 96:+IEumQv8m1ccnvSrwnOWW1EkWfEnFBoQDZJh4g:+IEumQv8m1ccnvSruaogJv
TLSH
T11FF2EEFB07236105D98444B0A400AFCFAF16404B47B6B2EC76D447E3F3A25E2B5B9B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 189B
SHA256 de190a5c4b9d2ac6f8c1f11e694460ce13e076c03983cc8e2c5b888773a216d8
MD5 b06f7b7e681c17b008c6691d55481856
SHA1 41b84034e25903398e4bbcd68cbf084d2e89d72e
SHA512 7fa145bca6f1b81392070dbba838222cb032e8994a49626b4ec116c9a450ca0db41b0db83f5a8e185e0f7eeb861323613ff0cbf6154df6961338d8ff49eaaa7c
TLSH
T1EFC080E389B56477502C05BB6C18E81957FD5C30417228E7DF9AC02DE1425F62731406
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a55d2bd05d2c4a987cb265551bf684091a8f660d612edbad49488191a8d0df3b
MD5 1c1a0bb79612a2220aabc44a90bcc451
SHA1 831936ed2336f9df1b5b8098194d068bb5095ef1
SHA512 16d45b5da7d0de1b6f1c57a7b4695578353947043c9c2e4c5d146d7e8269e563ebe276b442e1bbca0d11fd8d3ab408c8d5516878b2e041e3d77af75690b4ee83
SSDEEP 192:sxZ7RLyMqZ/K1Ml8e9w/fWsMWpVb+aJ81FRyzodpLHW6+WNGY4x2nPupHzIgbQrJ:sxZ7wZw/fWsMWvb+MKdLHbGPBE9
TLSH
T14872E7166A28597BCCDBD309FA557F63D7F9152392904E44A9FCCA0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0c18544b86967b76859124a9c55df882cafa663c95d3fb54955d6f096b77e290
MD5 dfe27a997edc09e257c813584a070f32
SHA1 0ac2f2aa3d3be1564317e3c0e2c8085995a251e3
SHA512 81d979dff8f8a31d72831bc4395f68cc6bb408bfafea50c80741599fb4f3d7ac1b0d2aa83cfd2da555f8d42e8522dfe02d2a7382786401c0487e9d89fe72ff0c
SSDEEP 192:sxZ7RLyMqZ/K1Ml8M9w/fWsb+aJ81FRyzodpLHW6+WNGY4/2nPupQhIgjrJ:sxZ7w1w/fWsb+MKdLHbGhcj9
TLSH
T14462E7156A28593BCCDBD309FA557F93D6F9156391904E44AAFCCA0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4725bcdede0020c8fa93ea4c996f38687fed5fe410802694aff934a6fd83a9ec
MD5 8ab356f4d72f6c75b5ed16bd24e6fc3d
SHA1 6763c65ff6f70e28d6edbebfe38fa9b2e8bbfd57
SHA512 8acb37608de620a43cce377d5d3c3ea32ef2348949192c59286e215df78e3e8bfcd5799acea21153058330e063f64ef6b1c05339ab706ee0d34c6f6c27da3531
SSDEEP 768:ByYz+Sb7pLuL/W2WvW6dS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBtGBLldreduroJ:ByYz+StE/W2WvW6dSu1jawtGBLLCdl2O
TLSH
T115F20B3B680CCB7E4F804E9CDC2A7E9A6DE802CF9AD8885447F9944C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 59376bb2f5ae37dbbfa1a4b875b44760204321ce77da82d8b070e47910fc6c14
MD5 886ae2955be8b75c6b12b6cdd8ebce39
SHA1 35bcefa98671c93c0bbac7d66dfe4b327f416572
SHA512 4c6b9a713e0df45f42249d3288aacaef3b3e32e2a18c6f513681eafb1fbabf95727ca42ba33f098a5e2dd053c7668e0cbbae1760c60e83eb82e4b5ea359a5783
TLSH
T19EE026145ECECDBD609B37570238DB89C2E4746BE3C83D022FC1EB447146A24B1A66C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 43f7c57cca794884ac99e0a00e55c10c7a5fbfb9317f5b6afe230d55987040a0
MD5 342d9200bf46ccb9699f043f7774c10b
SHA1 b2d5e5d978518fc9db56b653d4cb3df17e51e2e8
SHA512 71420a5b88a3cfa27a614cf4bc27386f6af4cd879805d24672ad85374186845d0cfe3489cbd1b71f3d83f4da15b08ac6602069ffb159d44a279cf71f2d9a1b08
TLSH
T16FE068652ECACA7A31CB3497123CE709C1E33126D7D938212F48A644720A64072576C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 5628bc2bf526d78b67f85683fcc088646b46fa4f3db94f41ef2a95bf03afd7c9
MD5 b9e91c39eb7368bf01821c4ab0888a09
SHA1 f4b8b8890c6fe9218968288bc339ec13a4ea1ed6
SHA512 5bf17a9b50ef669f76c8262cfb9a41384d73f958fa7dae1c04a99c60ecfb79794812a8ff5c5fc0a476e4f3e99be0c073a15519950be61d458292250478bce594
TLSH
T11BE026B45BC8CA79558876A3426CFB0ED2F07C4A93C83B025B4C5444B142710B3BB2C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 09a52c4701d0604ffcee5cf1dc7b44e2c36f03302c35e2e6af36831452937aba
MD5 908c2ab1345858d980bee6ce5cf7d165
SHA1 dbf26cab9d7e1e69fe4983ba164cf7a0428a9ec5
SHA512 d740fd4075489126272b0a973b55f8aefb7feaf26610a9d7df86e63a3a13c9960be443886710a19f73cf53a9c65a46c2dae02d06b475b5111d187934782a9d55
SSDEEP 192:spVXRJp5l/NfcNAsiuy/GLAE41EqnUE7KWJhN5dyduy0UErMXCiKnQ4HCqfQodNP:sPXbpH/jZzNzVDnxJTgLbQ
TLSH
T1F4C25511713A52903A7EA9CA85D5B86E52C331733019A42B7BF904A61F6BE20DDFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6fed59f90d0b8047ede56e8c446e974d250cdd9fd057d4a402a9895cce44ab27
MD5 96a16fc735fac32a23e4b6b9300fae5d
SHA1 53299ec21ef404e2ddcf09b942cc8d6c0e67d8bf
SHA512 ef323fd6ba1c8acc911352755ab2acf86759e7b7b1d3dcfca683ba35f0568610045533a5dde479b9a0a0790f5b57ee556b11de68b6cecdec6cff340ffac6bd06
SSDEEP 192:spVXRJp5l/NfcNAsiuy/GLAE41EqnUE7KWJhN5dyduy0UErMXCiKnQ4HCqfQodNW:sPXbpH/jZzNzVDnxJTy
TLSH
T184B23515717A52903A7EA9CA85D5B86E12C331733019E42B7BB804A51F6BE20DEFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 55c6a9e5abcf1f00d43afa3538b4de97e80a02cccae43a3709f4547eb84c5a81
MD5 079856981518c2a32c3eb5925c7e1401
SHA1 aa00f867fdf6170ca060939e224f950f5eb2cef7
SHA512 6e53b68a284f4e3d4b8442d0dc9d3b40752ff4d3c7f1a2313f87cb70586f365b59dd4d9807d7cc122f48a55db25bd42d6fd3723b2591f77cac595a196b63656c
SSDEEP 192:P+xW+MfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxyfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C624630A7B747001EDE6D9725CB080771A3CB16DCF22A6915DB254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 17091f8827add4d4423e4e110240a41339d88e41eb4cff8f110447065daf194a
MD5 a681c31adb34df385060e3deba37fcc7
SHA1 df553e5b3764bc34f0b9f5b14534ad2f55d5e50d
SHA512 0762770cf946a63cef3fd0fe827332077ec273a957b1a18136b701cfbfe2a5bbc7121c528b0580b65afb4026f60ea2d7a18797c03ac2f77ee9cc685e2153a1a3
TLSH
T17E5146C0E3AA64D46F89B9C2C2197803A5E53E6A350F68B2736D44F55F48C249F3FE25
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 55ca985103fb1cfe307e2f020d0925a1bc77c6bdadc438683667cdf918296e10
MD5 4ecad14313a8f0da650b2b17e7a14daf
SHA1 62f48a6f1de5060d5fa471849b3a948f4e52e2c8
SHA512 4411fc865c75ddb13b3bf33167361163ca2edf9ee210f0da25a94bfb80c948fd1b315d5198f3fb919da14c0951d3872de9bc17e9aea958590a1c22bf4c5f74ca
SSDEEP 192:jCO+JAsGlrzyQ2sAM3uF3l9QN5tIIIIbwMIMi3YcYg:F+qskZ2sFQQFIIIIbwMIMuBv
TLSH
T1C572A65967250B73C26E6B7601AE8B5507E6EC5A0D62625D7020B44FADF2B23CBD03F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 47d539f149420ffef533293aa60e60984d8a07a28b9e71974b599863fa632399
MD5 f998ae213257406c6b5ea3ff0f6f10d6
SHA1 6023c32b86e9491f0a580a3db8150a9163cdf113
SHA512 892bd240fde10dbbba2a8a6fa9b34155b50fc8588af62c2e78b73c116281498aad5da457df3fdc23e9fdab688d78632886dd7d86e681d772558f99ec295e135f
TLSH
T1A8E02610BEC8C9BEA059369B0128AB0AC384388BFAAA29061F40C448B405B00F6EA181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 78ca4fb03d7a1b728eccd9a2447a45c88dd428b9569e6be33218e70b1d4b9168
MD5 86ea5a48e9bab4cd282bbba50643dd2f
SHA1 93854643bbff2cde70b2a59a9b4b3896544aa601
SHA512 d2179ec447cd8e742f9a985d906d18b9b65d502d817ff9103b91ba0cc51e050bccd3be8d0f0fb70e589038ea71f2edee3cb0bbe8995414e1b116af6c46323d50
TLSH
T196216056F320C148D14A8A3DA46E97351738DC129FBCED0F957920392D76E011E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 ca016ea9df5f51982aa239d904da543642b56310c7301dfa7e252998677997c3
MD5 1154209bf815bab6d0daf132aa7d6ffd
SHA1 2f2c955ca3a0ed8cc2968c25ce56ec7c50bb2e77
SHA512 a1c19cb534b6c5dea7d59fec21047fc9c2240568675c9059567695f39274a1c59ce9862f7aa46d26126b1ea3a43a2215d63ca571913ed45d4fa403c53217559c
TLSH
T1ECE02690BDC8C9FF915936E3016CE74AC2E1388BFE982E021F88CD88B141741B2AB1C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 f57c193674ffc33dce826b42c80c368ce08e2fae2995d040ce93283c1f7e0c11
MD5 89b5c5a14f1e43f6c5af0f94b209f48e
SHA1 efb0bca2dd7c32acafcf222e78ddd8fa8f005399
SHA512 f52b7465fce557337358a12ab78948fb6fc20da3715b32072039da78ba53f0be686ae2dc1b1a38cef199e1880f2dbc9e35eac68204a4be0473e3f4ecc0db4c97
SSDEEP 3:MsEllllkEthXllkl2zEfl5zIl:/M/xT02z1
TLSH
T11A440404FFC44C05C540F0305053D35013F0F450071157533CD1143F5CC75471C44010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 03d78a3d11f298680c93ca9784cf60be25f8b4e6054cffd2fddf4ef9a440adb3
MD5 1dd2c950513387f1eb415ab5b2bd6941
SHA1 a371b1669fdee5a3c56c5c589f06a4c3a8491270
SHA512 d4d4467706e2f8425d5526790fc350900bb2e688892e3b3e4b20ae6e70b860f4b363dd3d637402308be38dc3788fd94c71d458b2c7b78af3cfaeb57bb21875ec
SSDEEP 768:iFayv3kwg3pr7GY6+x4XzMQ0x/dS4smpuH:Zyv3GM+x4jMQ0VBsmpg
TLSH
T13FC25C75ECA8CAABEDE74FCAA7097B47EEE001AB959C4AC4DAD81D0D00871DD1347C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 be9bc9f132fccb5ad2adadb047409b1867d734ff156175ad691c47eb11bf013d
MD5 add631b4d667ee8ed356580b21434b60
SHA1 dac52b24c8136bc471548ae7348a6dd56eb5d916
SHA512 cb6bf354d8ca65a52c7032a33a1f03f7ff97d83096974ad05c39012428a08338b652cff5c6f099532a82cb74770201363a428352bbf6afe18489b7ccdb77a42c
SSDEEP 768:SFpccQj3HwgPprG9Y6+x4XzMQPtKzXabW6RzNt:KccQj33U+x4jMQV6yWwt
TLSH
T10CC25B32D8A4DEABEDE78FD5E34A3643EFE001A795884AD4E9C85D1D00875DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5ccbe4d9e578767739e7d1056e19dc4c17d3ebdf0282f684dccf02000fedd72b
MD5 33cfb295a33d959a0a6a92db15b966bb
SHA1 f92f5a5f1b8484d8021233e534795f090328dc41
SHA512 d9f82ba4d20db28e19e7b95a5d1de557a02de64ecf3877c7a901d0521660363b145104c4eebd8b2908d61877720647c4c11a92686cd2221d345202b9a29dc7ef
SSDEEP 768:SFayv3Hwg7prf9Y6+x4XzMQPtKzXabW6RzW:Jyv3Hr+x4jMQV6yW5
TLSH
T1B7C23B71E8A8DEABEDE75FD6F70A3603EEE011A795884AD4EAD81D0D00875DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2e08b3aeb201035ef948c407cbf45e1e28d9c8979f8784285486efe022ea47a9
MD5 a49d6046189a21aaddcc80d7a27f6108
SHA1 76ce7adcee5006e3cf7ea74cb296e4fb1b492cb3
SHA512 c67a23124567808fd62420eda7c54d0824c2b1ad4fcb9cf444bbf87f0f901d46e5c21a0ece42ca82bcfba965121cdb8ed8264199c2b0eeaf69b4889c105cf705
SSDEEP 768:SFRccQUHwgPprz9Y6+x4XzMQPtp2bf2rW4ufdXabW6RzNt:SccQU3H+x4jMQVI6r8dyWwt
TLSH
T132F2293ADC95DD7F98EE6B88A34E2A12ADE00177D67849A4E7C80F0C807749CF707955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8fc014eb3c8cafec2b0efd42a564652bd5dd2b1bc289aabc13da0fddee8808bf
MD5 c465f77b4b77586d698f755ea7998585
SHA1 2768edf202ce8a38d553a857d1043b09e81a0443
SHA512 07ad7805ee908647412532a00aaee6c0b681141ef354ed3d3580903e41a7808f63f810a5a6548393ebb7f67e17c268c6c26af39daaad08f703bf6237f471841c
SSDEEP 768:mFayv3Xwg3prKaY6+x4XzMQPtWzdS4smpuH:9yv3/R+x4jMQVuBsmpg
TLSH
T10BC24C75ECA8DAABEDE74FD6E7097643EEE001A7958C4AD4DAD81D0D00871DE1347C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6d18cc176b0dc34f2e4aed44ef8d887ea1158b9bb33927102e48e7db6654350b
MD5 3983340101e0171e10ef80244833810d
SHA1 908fd56b3e48d2da2edf6f5d752c3bb09d82e31b
SHA512 402023e19716b9c6947d71daefb0958142672aaceb7f6e4ff14fa42732da50c1f6f1b45d0d4ae94d6e8764d71920db4f17c3ac26ce0b004120a88d9b1ed554aa
SSDEEP 768:SFRccQUHwgPpr+9Y6+x4XzMQPtp2bf2rW4ufdXabW6RzNt:SccQU3s+x4jMQVI6r8dyWwt
TLSH
T11AF22939DC95DD7F98EE6B88A34E2A12ADE00177D67845A4E7C80F0C807749CF707955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 aba279d37033a5c567ff4a8433d49a05add44cde6ec38fe9463c720aca7c4c46
MD5 b17c5c3aa17768d1db77140000eba2d1
SHA1 a09d6ed954db51e1055ce35946a380ca594c9ae7
SHA512 49a1ee8f64b3f555ba8af008113db9424eb9768b2261f734defe858e3ff0dd9a8b3439e4a651c7b23c146b7d66e4f07b59bc24dbbc4b48d26f7dc7075b2dc7ba
SSDEEP 3:MsEllllkEthXllkl2zEflCCR:/M/xT02zPC
TLSH
T1D54404447FC54405C54070305053C3501373DD101555574334D1143F5CC7D471D04010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 4KB
SHA256 25753d167154ae0374a6d022be7e401f6d0a906c3a5186ab0a8c6262f6eb7a0b
MD5 34a7256bf28765160ce6562fc17337eb
SHA1 1f1f889b666abbe9d0dadde466e97de0d30af0b5
SHA512 9cc98e61dde3fd2388081e983c8c69ce73017308f8527c2152327ef0aefedc585a788208ee3d11531f21f5801d8ca5f0b0bf2bab7a2d4ca9826f2d024965a7ee
SSDEEP 3:aDlcn3llQ/8QuQll/lZAOSl5eqJ/cSFYojpuyOV9RUIU:aDA4/ZlaeyEGy2
TLSH
T1AB9112421700DDB3DC842F3F34C200DABFB219014F89EC0051749D520B85605761897A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fcd50a008d2e149f28f83ab1445f0dc4cfc13e27fde2cf73fe507edd157b2191
MD5 cb61dfffe7ed7dced26b977f4adcd7c6
SHA1 f04d15e577b29c93413116ae30fb164b1c09b52c
SHA512 88fbe1ce39a7dedfc25d96ec51737393a8ed85b21610b7482ce879aef2daeacfe0e543aa723710a86b31636f4646651d65f9577fc99fa640a4c34c0411557f47
TLSH
T1EC41079CB6F91044B3B76F5A9BF7A8AE487F7E372E06946E50110D8E0626A40D871733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 fde472fe93d6d24af6931112f0e639acc1dd0a38dfc7458b6eb3610b1823f46d
MD5 54378b8789832c779fc01ea1ce5c9ef7
SHA1 e675dc1b9900d60c086c1730a9141fc78cf6392f
SHA512 bd6c504038ca3e9a182204694ec71d19385231027ee82f6fb4af04c4fbf08774489e3d9b537a6902044e5b93001161caca7b0f9c6b48a6583db5b20a6afd5b07
TLSH
T1F7514E5866F91018B3777F5A9BF6B46E987BB8772A07945D10010E4E4A22F41CCA273B
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 b187f7c09734d8c294ca655fdf81b441d5d62c7af61328fa64cecc8f8adae151
MD5 ca072b104dd3383e5b3092fe50c6a1c9
SHA1 edba23e2cf576730e38666a7f6290a8d7f065513
SHA512 26639b248bd5e14564d5c110c61657a1bbae46eb9809611455b19c2e2455568c506d04dda60376694313eef2f215ef22fbaaf657bc1025431609b4b6ad3cc24b
TLSH
T16B5149D03535A23F8BC78BD560B64C8428A2F081037F9A5CAE5A4436BD5CEE1635A7CA
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Loader1.exe

Path C:\Users\Admin\Desktop\Windows Loader1.exe
Size 3.8MB
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
SSDEEP 49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt
TLSH
T1E6164AA4A7623073D48664720096D1720A247D307B5A26679BCFCC9F3AF91DEEB5C327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Loader.iso.crdownload

Path C:\Users\Admin\Downloads\Windows Loader.iso.crdownload
Size 2.2MB
SHA256 823dc4453ecdd4cff994653a55fb2e8b6229313adc767822aae1ae358abd93fd
MD5 cbe608d2d32e644e042a66b4a28e302d
SHA1 487e8de4bc815dcbb08416754acd919eec1363bd
SHA512 27898163379c037c269c4247045e5924e01468069810da7ff399d6b2a0e33db4b3ab36f97251ead55e3246d27a62399e8ca285723e8cf6ebf768eacc06d903a7
SSDEEP 24576:aNcBtkdOdTNpGu522pL8cX2QrOtUUqi8BQLvYOHgDD/bcNuh+S1hKlMLkhWgvoN2:91bGCfL8cX2N2UhLAX/+uh+S14sB
TLSH
T10EB52202BAC2C072D2722934943AA7594A7C7C11AF29876FF3EC7D2EA7B14C16534767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3124-495-0x0000000002460000-0x0000000002470000-memory.dmp

Download

memory/3124-500-0x00000000024D0000-0x00000000024E2000-memory.dmp

Download

memory/3124-485-0x0000000000400000-0x0000000000623000-memory.dmp

Download

memory/3124-487-0x00000000024B0000-0x00000000024C3000-memory.dmp

Download

memory/3124-524-0x0000000002510000-0x0000000002520000-memory.dmp

Download

memory/3124-540-0x0000000002550000-0x0000000002570000-memory.dmp

Download

memory/3124-532-0x0000000002520000-0x0000000002530000-memory.dmp

Download

memory/3124-516-0x00000000024F0000-0x0000000002501000-memory.dmp

Download

memory/3124-508-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/3124-577-0x00000000023B0000-0x000000000240F000-memory.dmp

Download

memory/3124-576-0x0000000000400000-0x0000000000623000-memory.dmp

Download

memory/5164-486-0x00000000016C0000-0x000000000171F000-memory.dmp

Download