104fd55a9c9afe36eaa2f6dbbcd2de37b14c807d3d94abd53a0460a1ad31fe38

Analysis

user interaction
yes
max time kernel
44s
max time network
37s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/05/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PowerISO9-x64.exe
Size 5.5MB
Sample260507-xvcbpsht4y
SHA256 104fd55a9c9afe36eaa2f6dbbcd2de37b14c807d3d94abd53a0460a1ad31fe38
MD5 ada6e99deca259e00bb4aaf68bfa7281
SHA1 7cb951af9acad3652d1464d88d7caecd9a6be0d2
SHA512 67b68cffd3f174ee557c372c0ce4a9eee167733c9ccf60fbd30a4d91f0227dbdb51245abf6a8f648d9a3b93bfc0a0da5f69c09308c13507e3430f5b4f3e76bbb
SSDEEP 98304:/JnqxF3UCmd06aowGwmogGfJC7NDhHZnmNx4ro9sjARKLYUfJE2w5AnZC:/JnsUH09xqE45tEQro9ELYUfJE2wAZC
TLSH
T11C46334676888AB6C40D05B1DF7A4720E9F7EC60AAF2DF4363D17724D6A08D35E462CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\scdemu.sys	setup64.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000\Control Panel\International\Geo\Nation	PowerISO9-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000\Control Panel\International\Geo\Nation	PowerISO.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
4160	devcon.exe
2120	setup64.exe
3492	PWRISOVM.EXE
5728	PowerISO.exe

Loads dropped DLL 6 IoCs

pid	Process
3988	PowerISO9-x64.exe
3988	PowerISO9-x64.exe
4264	regsvr32.exe
3508	regsvr32.exe
5728	PowerISO.exe
4132	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PWRISOVM.EXE = "C:\\Program Files\\PowerISO\\PWRISOVM.EXE -startup"	PowerISO9-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\PowerISO\Lang\Arabic.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Bulgarian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Japanese.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Swedish.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Portuguese(Brazil).ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\piso.exe	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\TradChinese.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\French.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Greek.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\croatian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\uninstall.exe	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Readme.txt	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Italian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Slovenian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Bosnian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Azerbaijani.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Burmese.ini	PowerISO9-x64.exe
File opened for modification	C:\Program Files\PowerISO\PWRISOVM.exe	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Romanian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\SimpChinese.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Farsi.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Serbian(cyrl).ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Malay.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\kazakh.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Urdu(Pakistan).ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\danish.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Armenian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Vietnamese.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Polish.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\German.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Dutch.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Portuguese(Portugal).ini	PowerISO9-x64.exe
File opened for modification	C:\Program Files\PowerISO\devcon.exe	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\setup64.exe	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Slovak.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Indonesian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\lame_enc.dll	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\czech.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Belarusian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Lithuanian.ini	PowerISO9-x64.exe
File opened for modification	C:\Program Files\PowerISO\PowerISO.exe	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\unrar64.dll	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Korean.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Finnish.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\MACDll.DLL	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\libvorbis.DLL	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\License.txt	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Spanish.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Turkish.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\English.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Russian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Thai.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\PowerISO.chm	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Ukrainian.ini	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\libFLAC.DLL	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\7z-x64.dll	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Norsk.ini	PowerISO9-x64.exe
File opened for modification	C:\Program Files\PowerISO\PWRISOSH.DLL	PowerISO9-x64.exe
File created	C:\Program Files\PowerISO\Lang\Hungarian.ini	PowerISO9-x64.exe
File opened for modification	C:\Program Files\PowerISO\PWRISOVM.EXE	PowerISO9-x64.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerISO9-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1976	msedge.exe
4428	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226546431128090"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\ = "PowerISO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\ = "PowerISO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mds	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	PowerISO9-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\ = "PowerISO File"	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.daa	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uif	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.isz	PowerISO9-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.b5i	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcd	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bif	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dsk	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cbz	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3579476765-2645189491-1706875375-1000\{E8291E13-A74B-4BC1-9FDB-AF1E69567E83}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mdf	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipsw	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.p01	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmg	PowerISO9-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.uif	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gi	PowerISO9-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso\OpenWithProgids	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\shell\open	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\DefaultIcon	PowerISO9-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso\ = "PowerISO"	PowerISO9-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8658416-7CCB-4c1d-A021-AFF0A2EB8004}	PowerISO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.flp	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ = "C:\\Program Files\\PowerISO\\PWRISOSH.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PowerISO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nrg	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pkg	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PowerISO\ = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lcd	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gzip	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	PowerISO9-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerISO\shell\open\command\ = "\"C:\\Program Files\\PowerISO\\PowerISO.exe\" \"%1\""	PowerISO9-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.img	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ima	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cdr	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	PowerISO9-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bzip2	PowerISO9-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.daa\ = "PowerISO"	PowerISO9-x64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3492	PWRISOVM.EXE
3492	PWRISOVM.EXE
5728	PowerISO.exe
5728	PowerISO.exe
5728	PowerISO.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 1032	3988	PowerISO9-x64.exe	88
PID 3988 wrote to memory of 4160	3988	PowerISO9-x64.exe	89
PID 3988 wrote to memory of 2120	3988	PowerISO9-x64.exe	90
PID 3988 wrote to memory of 4264	3988	PowerISO9-x64.exe	94
PID 4264 wrote to memory of 3508	4264	regsvr32.exe	95
PID 3988 wrote to memory of 3492	3988	PowerISO9-x64.exe	96
PID 3988 wrote to memory of 2920	3988	PowerISO9-x64.exe	100
PID 2920 wrote to memory of 2916	2920	msedge.exe	101
PID 2916 wrote to memory of 744	2916	msedge.exe	102
PID 2916 wrote to memory of 1976	2916	msedge.exe	103
PID 2916 wrote to memory of 32	2916	msedge.exe	104
PID 2916 wrote to memory of 32	2916	msedge.exe	104
PID 2916 wrote to memory of 32	2916	msedge.exe	104
PID 2916 wrote to memory of 4012	2916	msedge.exe	106
PID 2916 wrote to memory of 4012	2916	msedge.exe	106
PID 2916 wrote to memory of 5656	2916	msedge.exe	107
PID 2916 wrote to memory of 5656	2916	msedge.exe	107
PID 2916 wrote to memory of 5656	2916	msedge.exe	107
PID 2916 wrote to memory of 6100	2916	msedge.exe	108
PID 2916 wrote to memory of 6100	2916	msedge.exe	108
PID 2916 wrote to memory of 6100	2916	msedge.exe	108
PID 2916 wrote to memory of 4292	2916	msedge.exe	111
PID 2916 wrote to memory of 4292	2916	msedge.exe	111
PID 2916 wrote to memory of 4836	2916	msedge.exe	112
PID 2916 wrote to memory of 4836	2916	msedge.exe	112
PID 2916 wrote to memory of 2024	2916	msedge.exe	114
PID 2916 wrote to memory of 2508	2916	msedge.exe	116
PID 2508 wrote to memory of 2564	2508	msedge.exe	117
PID 2508 wrote to memory of 4428	2508	msedge.exe	119
PID 2508 wrote to memory of 4556	2508	msedge.exe	120
PID 2508 wrote to memory of 4556	2508	msedge.exe	120
PID 2508 wrote to memory of 4556	2508	msedge.exe	120
PID 2508 wrote to memory of 4504	2508	msedge.exe	121
PID 2508 wrote to memory of 4504	2508	msedge.exe	121
PID 2508 wrote to memory of 4952	2508	msedge.exe	124
PID 5728 wrote to memory of 4132	5728	PowerISO.exe	128

C:\Users\Admin\AppData\Local\Temp\PowerISO9-x64.exe
"C:\Users\Admin\AppData\Local\Temp\PowerISO9-x64.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s /u "C:\Program Files\PowerISO\PWRISOSH.DLL"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1032
- C:\Program Files\PowerISO\devcon.exe
  "C:\Program Files\PowerISO\devcon.exe" remove *scdbusDevice
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:4160
- C:\Program Files\PowerISO\setup64.exe
  "C:\Program Files\PowerISO\setup64.exe" cp C:\Users\Admin\AppData\Local\Temp\nsx6446.tmp "C:\Windows\system32\Drivers\scdemu.sys"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  PID:2120
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\PowerISO\PWRISOSH.DLL"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files\PowerISO\PWRISOSH.DLL"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:3508
- C:\Program Files\PowerISO\PWRISOVM.EXE
  "C:\Program Files\PowerISO\PWRISOVM.EXE" 999
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.poweriso.com/thankyou.htm
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.poweriso.com/thankyou.htm
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffc9d5cc188,0x7ffc9d5cc194,0x7ffc9d5cc1a0
      4⤵
      PID:744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12092845231024215062,195251296581442461,524288 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      System Time Discovery
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,2700225822849170448,18120729835734749787,262144 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:32
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,7243181214654110141,17560575852530520508,524288 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,15939001496668302118,16786849434899316822,2097152 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,13829773341647347259,10330059454959178679,2097152 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,12026012085492819658,3267028356943644387,524288 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,4234398117219545184,11310032522529921331,524288 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,74117299449971422,9765106470101147785,524288 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,74117299449971422,9765106470101147785,524288 --field-trial-handle=2304,i,15826287644122532163,2770735393265814217,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffc9d5cc188,0x7ffc9d5cc194,0x7ffc9d5cc1a0
        5⤵
        
        PID:2564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,2578392964766402956,12069153147370792676,524288 --field-trial-handle=2224,i,13842596621463142313,11275247141551680064,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,4918865963489635759,17759940702010928852,262144 --field-trial-handle=2224,i,13842596621463142313,11275247141551680064,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,4861599836432090845,5907819240045771979,524288 --field-trial-handle=2224,i,13842596621463142313,11275247141551680064,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
        5⤵
        
        PID:4504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,3036937307772973054,6479508813422985317,524288 --field-trial-handle=2224,i,13842596621463142313,11275247141551680064,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,3036937307772973054,6479508813422985317,524288 --field-trial-handle=2224,i,13842596621463142313,11275247141551680064,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
        5⤵
        
        PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4580

C:\Program Files\PowerISO\PowerISO.exe
"C:\Program Files\PowerISO\PowerISO.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\PowerISO\PWRISOSH.DLL"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PWRISOSH.DLL

Path C:\Program Files\PowerISO\PWRISOSH.DLL
Size 353KB
SHA256 6dc7433b365f40c78d54b33f4bd5f544a6fba812c48082403f11e12c8032fd08
MD5 acfa66b1c65e8e6715475e8782c2567e
SHA1 1e42a5b010657a5817f79ed28a9ea1e3d4c51e3e
SHA512 61ee6662d2949010971822b4191b0f86fb50d4357a7af178093e93d2a8273c32f9ab8b9c7416e76433deacc70d5c8a660df6eba734369b73c63850c4073a3a58
SSDEEP 6144:8h9rT3/gC+VBeYDttSQ2/toyzNQst0+egrNZRrvnEDAuErgGBTKpk:8h9rT3/gCE4YxtV2/iy/eOnEDAuEs1y
TLSH
T1AB743945B2948E75E87BC579C9D29749EAB23C109B31C6CF0214BB1E1F337D1AA39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWRISOVM.EXE

Path C:\Program Files\PowerISO\PWRISOVM.EXE
Size 445KB
SHA256 9af040e4ca36ce8b0d754f1230926133251992f23b6dbaa37241f90e3b686c5d
MD5 de48a4339504b94a6edc2f11bf1c1dd6
SHA1 4350feaf80f86e6a95e4838cfa8f5bc9e8860e92
SHA512 15ec35f1db07d0be791aadbd4726d99fb21cb8dafb6ae0e50e608ea0c1be6eab433aaed4f3ac3adf927afd6562f99e4eda14afd2474050586b680ba3092e362f
SSDEEP 12288:+OAbR7xKO1ZybZu5ee4np/BsmJtKt0nEDAuEe:+OASO7yFPe8Gm6t0nEsuf
TLSH
T165A46B41B3A08EA5F877C63AC9D38255AAB37C149B31C6CF1254B71D1E333D2593AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerISO.exe

Path C:\Program Files\PowerISO\PowerISO.exe
Size 7.8MB
SHA256 93754a064c4ff5faf023579eeab20fdc4e0600614318ecf64204e50c74f5edb5
MD5 b3bda0e59410084d25d403dd3f868ff9
SHA1 91b6571b7f800492b80a292dd2538c018b3ddfe2
SHA512 3837188d0aad5444e7cb9f0dcdeb686ebdc14358475e2efd484685b16841418e8376a352d3a4f71a50fb345a1abc992e10891e1a4f48919b38df5687dd33bd46
SSDEEP 196608:dV5nI8TOhc19ERV0tTtPDZfgOwdC/S63gdPWBCHU:dV5nI8TOhc1GRV0tTtP1wEL3gTU
TLSH
T1E7860851B3F84229F0B3DABADAF25256D9777C525B31C19F01A4A60E1E32B918D31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path C:\Program Files\PowerISO\devcon.exe
Size 69KB
SHA256 8dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42
MD5 9d199564b65a91a531b23844649459e9
SHA1 8d84359ced1c51d14e70cb5ed36a6083c8b914cf
SHA512 ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1
SSDEEP 768:Ubrbmi0iAETVvlXjkQnr65WTHBAtgYSofgevxHs4gZWk:ab70GdXoQr65WDBAtgYSoflxHeW
TLSH
T1AB63DB0263E94608F1F7BB306AB552619E767C849F38C6CE018485291FF3ED0DD79BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup64.exe

Path C:\Program Files\PowerISO\setup64.exe
Size 11KB
SHA256 1f56046a9fa1417f6a0592bcba0e2a9699878461305caba93f04f14c9db8af60
MD5 7d48a676e9f414f0a3c78f8d4a30d3db
SHA1 58dc4271ca843325263c12b4cff7cb09a32a9fb3
SHA512 04e1955b0620daef04dd71db6a17529a7792d9ca0162f1c8d72f635cfdfc5b22b62d9d5b344db5d1ffa838ac0e78b7d3e08c7b342cf6b55d79417c3ba066953c
SSDEEP 192:qITwtvHiBYm2HW5wDV7YyxMiBNCzfMQZ0bI8KmMwUani64m/BX9n:zTwBHiBYcYV7GzkXhKmMwUaym/BX9n
TLSH
T16C322AD28E2C94E3E9868E30D1D66417BD7379C8179D60E7A160D0516AC63E07EBF13E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 356097950a080c4c2d8b1257d87e7f79ca53942f8706050e395f43a153335a3d
MD5 2ecce34585f2322d7de19a4812ac8455
SHA1 1c050a79a5d3cdf32f805ec222ce558c05438c0c
SHA512 e8b93fd7314fde5122b2a3c5d78870cbe653e649672e2e95fdcddea928700f2cb79d14648c8b1dc594b6d8f7cd12a48c69f069d001b0b3fc3c01c424f2750187
TLSH
T158D0C06800B21C35CCC1813024D977447F2FF453484E431224232C3C0C930003C4E0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b37bb023c533f676ade41ad5bc7174d63ad6e659dda025778917f16726aa2fe5
MD5 cacdc4bd5f245d655e043226a46cab74
SHA1 1ce45fe6f830729bf4621b2c726c26b4ee725fae
SHA512 b23b776527e45b08381bf39db13c1dbd04d7d3f7639ba7a0d5316731d6516e1d7fe030f03ed4be62a612b1dcc228dad7e55cb1ce84c3906757663b1e4b2bca5f
TLSH
T158D0C06C00B22C35CCC58130249977447F1FF853484E431224232C3C0C53000384E0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ba08f8a530c21f05438c749e9d47f3d61fafd5164fea54bf0e4107c04feb01d
MD5 2cce0eacdeb16ab793ca33b70cac5cdd
SHA1 f4f83a06edc735fcdc11e1ccbbc1c36f37803b6d
SHA512 e51dacfbf80914372479d87a519dc7f168d45c70b0ec1a5dea859f68d61b478c17534ee46ab92e035382a62cdcd6e569cfd468398e506ddb822c8509e056b615
TLSH
T1FBD0A776654E701AD9695230A163C3456B6BA851248B4741F308C44C49B90D477CA5CA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1d79d5c048336a6195c174083f43f1f1a3f23d82cba78701c76e9072b52faee5
MD5 f8eff602afc14ab5188dbd1fd00f7034
SHA1 d6b56f384841d33999dea77810d13b7ba2222ac0
SHA512 65de2acb02e90865f7363c1a81fe40a611ed9241b7d785552ab590085c2a2923c4e44c935c7e25dce2197be3bb72680d45cc8a18b75c3ed3ac765d43a200568a
TLSH
T191D0A736190D7405DA869235F052C740676BA816645A5B42F214881D897509437CE1D9
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fe244b1a4906b0f26f8905850febf54bd94d2c6cea3798f3b8052423b804e272
MD5 9ffbd349cad0b2decd32629086a8938e
SHA1 bd4d25839a5164af15722aafd261ad334f63c892
SHA512 7981904927c965be55e1712beb6a6cf8d4739d08e976da890c807df88ba5baf067281394a53158b5b914a19038d517b852f4c97847d0a323a6e119eb4d8941f0
TLSH
T10BE02B9BC921E83B0AFD071960904746FF41435B6B81491F3B3C92088FB9A3A858682C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f1aa54b6c7c432a71662a3729a1ef4b7eeca551a4f00b55b8acded601d10c044
MD5 1de91cf222a53478024564cb6ebdb9db
SHA1 0f68b66ce6c35c5389051724539cbf940d3fd0a4
SHA512 7d8cb9b103b63d016644581db3e0a476a4f04c6b0e75a8a06cc93b8c56a6cbebec475ef24b61d02a4066e6d42729c36f0699912652c27a2c5d4e09bc890c556e
SSDEEP 384:6XppSSgwQ0vRLbqimMrPYdCpQzh1xe6HJE3f27:6XppCwQqRHqxMrQoWzh1xHpEP27
TLSH
T142135E3DB29C1D73DACB5ABF4A4BBB356772C461C7C120034624735CAA18F2A782D972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ab5978e5cf06031519991e409ce4feabe2d64cce0b93839f651485154a53ef30
MD5 393fe3088d262675034f688797b43b08
SHA1 32f6d6ffd368147c70a151dd15feccea7a871dc0
SHA512 44eb28d91bbc918aad475103f9fc92b8e96eb3f4074eed661fa623f593b505919c4670992b308f191112425abc4636df3e961b781893666f905c14ae8ca2a7ff
SSDEEP 1536:qku5SHVUKmJ11Fg4yz/JzvDePrRQQrJZ4AS/olEWeqh:pEjyzd7eNR4qh
TLSH
T1FE445FF74945A02BCFA802F6E2133A3DD17B015D2CE1F9E9D67C0C852825F22B6BDA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 8336578225086f31370341da40997df29d9bd1688787f0606780fbc0911f36ee
MD5 541001d9f62c88fd4eae79bc0b79a97b
SHA1 6e3ce9d256390f7b946bdf600a33560e6af33151
SHA512 2051a08e3b954116b1a0aaf5797a20aa15590728c30d836c5eb1bb609c60310260847b45fbf68727d5222662bb0124de7ccc628542051052d28efcab16f3a7d9
SSDEEP 3072:uS5mE+H8meGw8F8MHWLFeW7IUmcQWhawzlmArZS5:h5nmeGw81W5ewIUmcQWLZrZ+
TLSH
T1E1255BEE8B382C87DD6B4D70B4E0FC22BCB421937616E1D34818C990975A3C6679B5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 635caeb3a47c16434cfada24b3f5fdb0a05176b801d3a211079464befeb3222b
MD5 168423c38e2f4a5486531f07b8b550cb
SHA1 502b3c5dc5b50144ee696e249ecf7f20ec542ad5
SHA512 b488ebc401f84fa97402e48a8525f29dc8b2bec6c192505f72918b7fe98c74c3901831b2dc55437287f071c04d028f558d78a1bf61449282b1ad67e3165a9f95
SSDEEP 24576:NhWPYYJquuUo0rP8D7ytnfuvrvLGx9AUozh1Fpp/AfCJdwHZYayv8yHe4xl08Kzw:70/7oEUHgfuvjCsUoDbNIC0H0v8y
TLSH
T126867EEEC6785C83CE678A30B4E0ED477C7412C3B595C1D38958C69812A77C1BBE92AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc3b04ee534c72e9e58f0858cc66f09024a79a1c5d4ec8e38436c58033f2bac3
MD5 d8b0b0679e6f91d43f75f29f839901de
SHA1 7520fc02134718851baac262127e5f6d8d9a27aa
SHA512 c23651c44ea1fbfd4cb88090043a5026cb9a913b399c3e1462b76c52b5aa3b8098f632620d13af222467ac8fed8c1afd875e6848279a84e30b6ee51806b37976
TLSH
T13661D2436192B16CEFE39FF50AE33049B964A67807861E6203F103FC5A09F23898C332
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 82d300ece9707724f67192bfdfe62a9b524fe6272e41d4c0454ebb7fd9c46ba2
MD5 3efd30979120f9e233afa5f69a918971
SHA1 e4384db562b18b35c3e5ba016872a003331e5e0b
SHA512 2740ee2be333ad09f293c94cb52f0e29fc471ac14a847d9ad45dafc61d45160a4f8e95f1a854c3e3a2c436c435edb054226fd15f175c2d128e351e7ed7ea5f90
TLSH
T16FE0D8E564C7C21D592574C79224EB4CD6C43487D6CA7E4B6B00CDC4B602903B395A76
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 0348108a513422d1e34318197c7b0559ac71c237e39086a607ed5e45819db03d
MD5 67bd026ba68896b64787b32c54d21549
SHA1 114e5da87eac01685eb4e9c313abb6d346669879
SHA512 ddc296e69be88d8260caf565501fd52144c2bab5aaa4d35e7b7ef4db3d566d4f946a20b4390cc6aa8bcf6c25ce2f0f2ed40ef4053d329720ccb7926ca26d49b5
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jSp6W5L0DK5fKFtISqYpF:Tyi+7f+UZD4jJ/BK6Wx0DCKFOSTpF
TLSH
T1D7E2E08D3B11F511C8FD733DA0C2C6E05EFC682C874D7071A13859768C53966F09E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 1a39ad25a8adb9ff04453a1ba66a7e6c089c05113c2c5303cf7858dce3c40911
MD5 4bd66b03e73f784ffb6a2ddf395d6738
SHA1 ce3203055c832940b0c2d5e11287883d8517cb70
SHA512 94d794af2e65e45621535e6f5d3d55c499cfee2c4bc8dfccb78e1bb80bf79435182d5d4d033638b8026d2a94d51a7c972045c3ebc4a6a7b546d8bc79cdeb5e32
TLSH
T12CE0805444C9D219651468D7437D934CD6D73547A7C43E452B0DCC54A101F8673D9274
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 71047368a658debd0abacefdda96ee4dda9e134d16ab3c1b552cf08556b08ba1
MD5 eea9f63071af26c811810fe3184999ea
SHA1 8e741cf84a379ea582b8a4d5c84e0773487df488
SHA512 606c4f62e068b677b7758e950d28ec85068acaa5fdfecf58743bf6d092eaf49cec33a3d4458b738ec8ede73cc1faba7bdd8a4a6c28c689de32bc359a99b7cb5e
SSDEEP 96:3BCx5+5nuhI4kdCaDuyItBr7OchEQ16NV9lj:xaONpDuvXr7OkQVzj
TLSH
T1A6B239A39E763812FF191E3F286A0476C97BE1482FB9AEC634E4445A5CBD442D03C739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 7737d1d2bc9443cd223a6517349eb8c7bf0f61dd0d570d4bb3365c7a28b080d9
MD5 4e762bd7ca0d582be1cc862fe777d711
SHA1 e848320c333bb533dd6c999a4a8881122ee51f34
SHA512 bd5884dadc7dc0958baf67a14dbd49e7eebbde9164df9cf6df7a627b410aa5bc4ca3b5cbd48451eabddae20c0e52602029116a13a4e04410c9bf17f9307ad8c6
SSDEEP 96:nqIU+bGz83uy3+u4tgp4DLjGQLBze9z3ijBHMsDEuspU0wbtqrOQpPfR4J+MCXkW:nqf+G83uy3Ct7XBBKyH7DXspU3iV
TLSH
T183141F4E5F243721CDBD917669E744B35D6CF03FCB1266DA686104B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 9830ce9bd067580b135ac396be094e979c29b4d822505ba3b159426bec8cbddc
MD5 2f19c70105030978bcac456eb64dd19d
SHA1 baf6d1e1d1f4b1b9fbcc6ef4d6c8ea438bee6c33
SHA512 366ac625fed3aac8025568a15ea576090f8bbefc22881953f0bce2e37861aa8ed9bfdc5cfe075e347336c99826491ce0ee8732344ed83182d21815ccd5d8f012
TLSH
T119E0D86548CEC259760830CF4314A78CE7E5385BE6C93F461F0CDD45F001904A3E61F1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c9b9df4c7f41eb28a15e7c0e5891c6a579b7f5393ef1de47931e4ef8d7ac0117
MD5 aaccdd0d1186ae4c7e470841104b70ad
SHA1 045453b3912a19ebdb56b49038aefe858ac0a566
SHA512 eeae49c8bb0405843b9c06e26a8fdf090e778bae1113b1790b2935221f64092e38c1146f2c785b83e049db7cf3604f1a278078a09983e711fb7a089e34d05be7
TLSH
T12A41CDF783B4996D8A11D6F0BB186E2FCE6D0955435C3CAAC5E46E1BA3F24B0E10095F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 f6287e88d9b6cf486c7518ccecf68a394df9be549c24abc43bd18df51a5fe471
MD5 445524e41af8a881b1ccf1cda6bcaa2a
SHA1 2199b8c2fe2d3535b1262a57f07d0f079cfdaf35
SHA512 62ee606d5b2e1d8796ffed1b5054e3df5f24551f5e9611430952b87dde71aa90d713cc009a09a514823a8a4f408f4af5cc8e60f27ac2b9044268c4cd3b644427
TLSH
T1EDE0D833C0BEE877143C483E5EC5B846257BA43505C178ACC969926C70D05B7175641B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e7d49065944a3e9222e6ec78c2be2e93d5e60e5b55e4d4e740158839c09a2a16
MD5 22fb5753535083c64abc4f4856e2783f
SHA1 0295082463f0c54a24d62883e5af9bd64c86eec7
SHA512 bdff2e636398c7564618b253bf7cc4e6079d8282f3932780c2b6ee5e67021011caf371982cc3519c2328078007b63563b7ec444f162b2bffcfb6ac9b20c69e24
SSDEEP 384:sxZhCnK/fssPWvIx8irNthZ3HbX/a/sKZs:sJ6K/fvYIxrRHbPa/s7
TLSH
T11572F716A634997B8CC7D619FA557B53C7F91563D2914E48AAFC8E0C00E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b1664f44f7489f532cc1490b62be02250a64759cbdb24c4437764aac782009dc
MD5 ad996b3e6a8eb1bae94abc9eb48e7c25
SHA1 eed5fceb4a66ee2bc3e39838a5e3ab4d1f098ce7
SHA512 54c7b40b69402a0011dc728712ef0af6fc63a23689d822af31748e432eb0fd69282bc9c406c7dd75ed43e22fc88b977a2a51e2adc813f59109925a9b23725b19
SSDEEP 768:npoVwO+7pLuL/oAWvooXk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVArYvLlKQQB8rov:npoVwO+E/oAWvooXku1jaJrYvL45BnZ1
TLSH
T124F20A3B2C0CCB7E4F804EDDDC2A7E9E6DE8028F9698885447EA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 5718bfa36c2671cc0426e8a648a054398963a76dede88edd90e75301e0daf99e
MD5 07cce52d0c16ad389b6a77519bb4930c
SHA1 41cc5f254d859bb1ceb0ced43073afcbcab359fc
SHA512 ab83ab06c52a8b982a34d3d80cee9c513135dbbc4bd3946b334e445728b5b7ace78f53e2dcfcc1b860f5df984c22c566bdab8f45d5cc40dcef196489b8c18ac5
TLSH
T12AE04F6445DAD379646530830364C34CE6E8B46BD6CD3F422F44DB89A183E49B2F79B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c7f02981919ebc0948f4cb7d36cc3af3401051d292e754587e47205f039d81c2
MD5 18d5ca7ddaca8d79eb824d5fceb34152
SHA1 9bc2a239585de0bfb553c5f2eb85ed466c11ff4c
SHA512 030bfcf25e18b26aaf1fc03cf151e50c33a37ffe6c99d8d9404a55cec12232dca95a265a0b66bca92c28a40f0598315521f24742af51e5e4aec540677699836a
TLSH
T1D9B012903F15D15BC48818B08D80D740F720F50111D48553881DEF608F457F42F11DC8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 987735f6540129003d16b758af92360a5bd35d13295f97862055a5089be3f31c
MD5 ee42eaa81c5284beca000f4a0d8602e3
SHA1 d64e5bdf2247c2987375b9afbf781fe37ea137e9
SHA512 d3aa6126870ae4205f6216361deb7a91c7e9d8041d251680faa2032f96e37f8be35740438a4c6e68d257f95705c41902df86a148850d3717eaef08fc720776cb
TLSH
T1ECE0D82055DBC32A614560C75328D38CD1F2B547E6CC3F512B0CDB84A207944B3D7570
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 e0fa73f3dd7efcd694b2c4e820e7b4742b448fb0016bf8ead9ba1d5c5dcab99a
MD5 a02fd339f752b2b009451f025b4eb2d3
SHA1 c4d0c28eacfba1a81f91735b5117e833af06bb9e
SHA512 a66b7229d6527aa871f70b75c91aa0d46b1ecc823557d077690252a7d3c545f583ce2b0f5ee989c19b8b4b7822d6ea4b7940bc802b9e4f1063a04d6468d8518c
TLSH
T1AEE0DF7047DBC339640060D64368EB4DE6F0B84B93C83F829B088688E102A05F3FB5B0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ecb6183829cd45ea07dc4d3edd961a100af9498f837fa84b889cd5d83699c722
MD5 8567d2e320b7af711a179c328fce93a9
SHA1 787efa385d9f6b76e1bde0a877221fe5c81d581e
SHA512 172fa56b6eaa1418d84484e4f1fc4f1ce26413d7f91ba7a517c0685f24ce65d9412796e380a863c923dd2a9af6c93c2f29949baa3a65ac7df1d9386d6dbf90b0
SSDEEP 384:AePyBiGv6mkE05sNWWuXIQdWuFYmb8T83H7i/Uzc+:AePyBiGv6mkE05sNWWuXIQdWuFYmb8Ty
TLSH
T14BB22715713B02903A7EA9CA86A1B46E46C731733019E53B7BB904A61F67E21DDFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 7d4049b48af73284d87f9901db1133b86290b9520d958031b6f542b2c44c2eea
MD5 a8e14b38203dc3b4e8d92d64b0d33049
SHA1 e372ee1ac3955ac4d95f5ff80cf8b6e783f08985
SHA512 f64b2a39641374aaada7464310b7ab741112e20261402d0f78e82cde7439e3f73055655ea7b09ec58f74c204ee0319e67da51b0be637b8d731ea81a7729ff3ec
SSDEEP 768:AePyBiGv6mkE05sNWWuXIQdWuFYmb8T83H7i/UzctZS:AePyBYR8T83H7i/UzctZS
TLSH
T193C23611713A4290397EA9CA85A1B46E46C730B33019E93F7BB944A60F67E11DEFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 3a12ed68ebfd3eb3f104510f56e963d5dd5704d1622a760800c0c2db47c5b671
MD5 c2f2028422b6695723ad6b65d0c52591
SHA1 295d61d552fd763dd22b922fd70162e702ef4483
SHA512 667128e808edc91ac907181a330330789eaa73663677130f7b1d92b497720971b474ed82046002b7a111d8b0ac73f9c3ea9223950c2a7ae4cb5026cb0a4aad00
SSDEEP 24:LLjGxhK3thdkSI5QjUsEGcGBXp22iSBgvY6L1SfGt:TEK3tjkSI5IUltGhp22iSBgvmfW
TLSH
T10352D0CFE9303112DDE5833546D002E17E3A503D8FC1FB0264D514500FFAA80932E69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 c172a25a91b569e6184e24da45af3263e456d3ec26bdf101b670d0242a3ec318
MD5 4afa979b46d9d72d83e0f643f2191818
SHA1 868abf06f529cd3caafa824197db4372f8dec63c
SHA512 1e0f29a7cbc35417c0a1c657c85a4c704c051d9e328ced498827d861adaebcb4a1b7880991f83898751219f61485f8a65b208dfc5e9ab96a59ed295d26e37842
SSDEEP 192:JFOIFAsalipEus7E/2zl6GQQIII3b3MIM10YcYy:2I2sQus4fGQQIII3b3MIMiB9
TLSH
T1AE52912A27011F33C15E6F77522AC6925BEA98814A71233D3521285F9DF2F538BC52FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 9432fe5cec98deb7aaf754673042d664e24edc603c1fb6419e3b1f49dfc79085
MD5 1da973be308d73f8440d8651b1203dd7
SHA1 1bcf940e6fa85af916c7980e104b06af115fbd2c
SHA512 8a0c65cf1fcf72a797d48a0236f4fd80d930c6832e911e015b0e451dd4d4d2913661623d8c2c8930ac840742dd1319fb9b2730b069237d57eae36cb09cf64e37
TLSH
T154E02650A9DBC36FB51424CB0234938EEAC4384BEAC82F861F00C58CF542D01B7EA5B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b63e78c32dbb375e3afa535f599ad5e7fc81adc9a15643ad420e0aafd7b271d7
MD5 e5ad34105a42f0560dbefe4f8ba96f3a
SHA1 87da4c0225c7e753b5af7ff06c5818252b544794
SHA512 bbc097c0dc1206fd23865c69d5276b17205f908a2e570a948ca712dd89c0eeaa2e6d44cb1ddde38b680f767df711d737f654ef18b78cd739ca8d1968e992f222
TLSH
T1C821BF56F320C148E14E963DA02B9B351338E8569FFCED0F547930396E72A011E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 5dc25a131b309d395e6bdca85d7cf06af21e21b9c5fc831bbef8d6bc804afbce
MD5 3533e6db1fd6e7d5b7f803ed8410bc0b
SHA1 0d13ae9d66b4838c9b8ccb4c5959b4b54dada640
SHA512 6f32a1e9ec5f324a06e19c1e142d73ba209c1588daf1c5256f2b4bd98c8a91b3d37af0c55b9582c5b038480bc3e0fb4a305d0e9e73821572c5a73d4e39d7306a
TLSH
T1C7E0D810AAC6C35F501130E70264D7CCE2E53847EAD42F421F04CA88D542946B3BB171
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 3667ec939178211c84b0b3c321dec4cb8da245223ce93daa39da0512a13b09f1
MD5 dcad015ef0bda802e98560cccb232ff4
SHA1 ba17e76314e0369f4754464fcd07b69eff816f70
SHA512 26dc911b20a226926fad8c82155217a3589dd33015c7f0b9746cb4eea6f188c117b42405b639475889f889cf8791c3c9d1876db1c04524a34241cf46eb345fe1
SSDEEP 3:MsEllllkEthXllkl2zEflXCfMal:/M/xT02zq
TLSH
T1F8440404FFC4041DCD4010304177C7701F70D4114515574334D1447F5CCF5411D0C050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f17ada244328e94ac12ee9c4427510001c39cf03eb475550431ba13d16336c9e
MD5 f83be350fe9230cd810ffab67395d8b3
SHA1 ffcf21a74990b962b17846c2219736a548d4d5e2
SHA512 96306916f03b32a71963e950d086c70a10ab6154248ceb14594d327256e82ddeac36a155048cab45421e01578031b3091bf0f3f5dccdc2d8eb13d87410239811
SSDEEP 768:WFHcpAJwg9CBwo8Yz7dBEjLpdyUKB9lNc9DnJ3HA:jAFCBwmd0BKjlNc9N3g
TLSH
T19EE23979EC548E7F98EEAF88A74D35229DE40177C5E88898D7D90F0D80B608DF74B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 50e5a37377889215316492b483e27420c5868f913c8337135681c5c86cdd07b2
MD5 aa572f220f23c6e693beb545e1ecc435
SHA1 f3b0cabb467fd76b6a9bfe4baf00bd3b14b15b55
SHA512 7e6d35757e82a5d64c65f169fe60e35e3ad364caa374ff9b47089d78c4946f7aa1084a054ba103667192dff8f03e050616472108f662bb00fe9b4eee0d11d192
SSDEEP 384:nsiFavqMg3sNd8TUNTUlImkrYwEG6rrQAS4f5YPr7CCBV2ZYl9dnS4mtmiRYrNlW:XFayv3GwgOwAQmYz7dBE6l9dS4smiWW
TLSH
T10EC24C74EC98C9B7EDEA4FC9A7497A57EEF001A7D58C4AC4DAC81D0D009719D134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d1662ea0f83e6a27a60b83c71e901a4b7a94e52c1288eb72b2208111d28a8b7b
MD5 43b81a4c5344389036681acb88bd7fe8
SHA1 3cb0694179e204d86cec0caa792a799e86ad555f
SHA512 08870ffe47617041069c528cfe54a29b40009720d0be41d62f3ea7c8f6e0a3badbc3bcab80d7f6835fe90d3e9c08da2b836ca371df2c53ef7246485e765523b3
SSDEEP 384:nUiFavqMg3sNC8TUNTUlImkrYwEG6zUDS4f5YPr7CCBV2ZxHr8FdnS4mtmiRYrNM:vFayv3ZwgOwDZYz7dBEjL8FdS4smiWW
TLSH
T1E4C24A75E898CABBECE68FDAA7493647EEF041A3D68C4AC4C6C81D0D00D719D534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c2a86d8fd0764e6325d60c121b5ba26523cf3c903862fd6d9cedd7f034f88833
MD5 8ba3592d2ad29dcfadec87cd2124b755
SHA1 c08b911137a991d4ff1cb67a02e7bdb7e2e7515d
SHA512 200de03810c463035f41c196634ad017befb1f517ec147c42128756db6efd02d1e65e860082739d67e988e26efe07731ed65177e604f06d6b857d2afc02a0bd0
SSDEEP 768:WFHcpAJwg9CBwd8Yz7dBEjLpdyUKB9lNc9DnJ3HA:jAFCBwhd0BKjlNc9N3g
TLSH
T129E23979EC548E7F98EEAF88A74D35229DE40177C5E88898D7D90F0D80B608DF74B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d2f7d60c7341547966afd3df2d302f0c649627cab83bd0c72cb2014df7bc45a4
MD5 9d63327cb7895c282f8ed2160f7c7b5f
SHA1 8384e8e8136e49f8fb3538dd6ac990eab0adce6d
SHA512 a982bc8ba643503f650dd8b2e54a2396810038056c90e8e306b57ff25522cc8066ebe8305bf743e014656aca17066833c2f0e5f90ee28ce1ecfd162f30b29677
SSDEEP 3:MsEllllkEthXllkl2zEfl0iYl:/M/xT02zli
TLSH
T15C440404FFD444C5D54410314053C3701770D4500D117F5335F1043F5CC75515C0C050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c9aa440290a34c328a0bf15be10e9dd86ab551e376c5721a70fa2574812a352
MD5 be689ebc17aeda119bf7376c2133eacc
SHA1 1711ef30cbefa74439b5c4bbcf2856f39110e068
SHA512 c918b5c74f748bc6f1170836947ab744aacae7d9cab8d6db28f89e2c1672f48407c467f989f3ed28ce0f5ecb887c44ffc4e0947acaa03846bd5174b8899fca7d
TLSH
T12641185CB6E91148B3B77F5AABF6A96E847E78373E06945E10110E4F0A66B40C862733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 37b844b339a2f2766c28737a79b29abd06d4a0b4b49c4a8e676ff8cc376b0c46
MD5 bd515f79d895ea982b51c44babdf3095
SHA1 e40a66e5340f461b3ccbc668c5fe4adef4f0498e
SHA512 cd92f7655b837e911afdd4990f34fef335941d0caa03557fd228f4086a5c50a07e9f6c0ee37d86b41d9eb64169dda7284f6e4512e823a2c58a2e44d4c6e4c3ed
TLSH
T11A514D687AEA1154B3B7AF5A5BF6BC6D497FB9232B07949E00510D4E0523B40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

C56E.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\$PowerISO$\$pid_1660$\C56E.tmp.ico
Size 2KB
SHA256 b4d6704aabfcc8b7cb8f4ee58b162dd124e2d0e4dce20ecf13eebd262dd1e76e
MD5 4198afdeb9ace242c575ee572af22e1f
SHA1 32784594ec69ca459878010401c3931be8e5e15e
SHA512 d4288466d9a669c7735dc788f81fd5581876048644c48a58df5e2f8c70d468464d9de2bcbd295cdfe8510fd77a9a3cc26e3de0a1cf985622fec00baefda7f4cc
TLSH
T12E4120DF5550C28EC4E5E372D181CB3DB16D0AEE90882E4418517427BAB86DFEA17292
MD5 SHA1 SHA512 TLSH

Submit Download

InstOpt.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg3BAE.tmp\InstOpt.dll
Size 26KB
SHA256 cc4ba9492ae9685cbd11745899303f692024bdc34ab28537f2e2dcb17dfecb98
MD5 b06488998089cf179eb403e2f96c9055
SHA1 59a63d9222d359843c52ad3c3bc460eff2e7b124
SHA512 a1a43c29de86d70d6758d7eb9b57123bd58d020eb7fe0239efeeecfb007318f70756fb153e9849b587005969327f751211cb58abaad0f0ef8dcc14dbb520a0f9
SSDEEP 384:+3Bs7jQgah7UR6QnMn/2H/D/0DHWaH3T1/kaePv6O0tTbQBYcssR:+3BsYgIfQn4/2r/0DH7H3qj0FbQBYc
TLSH
T1DBC2C6D1E3E141A2F3FB2A38B8A56B50597DBCB1A87181AAC63337095874F42DE70717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg3BAE.tmp\System.dll
Size 12KB
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsx6446.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx6446.tmp
Size 135KB
SHA256 d01a58e0a222e4d301b75ae80150d8cbc17f56b3f6458352d2c7c449be302eee
MD5 92eae8dec1f992db12aa23d9d55f264a
SHA1 add6697b8c1c71980e391619e81e0bada05e38ee
SHA512 443a12a1a49e388725ee347e650297ba5268d655acd08e623ea988cde07ae08ae861620b600fb223358339eeab926fee1c8377386501310c68a3eb9515649441
SSDEEP 3072:hl1VSgPra4TD5Yt2JVLuPIqEjOZN7mPARacgx:hl3DtYtm+Ij2aZ
TLSH
T1DDD37C93F18550B6C9A79178CAE69A23D6B7F4141325A3DB64A08A771E03FF42F3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-6-0x0000000000F10000-0x0000000000F4B000-memory.dmp

Download

memory/2024-368-0x00000203B9F90000-0x00000203B9FE5000-memory.dmp

Download

memory/3492-522-0x00000000008A0000-0x00000000008F5000-memory.dmp

Download

memory/3508-110-0x0000000000710000-0x0000000000765000-memory.dmp

Download

memory/3988-116-0x0000000002080000-0x00000000020BB000-memory.dmp

Download

memory/3988-17-0x0000000002080000-0x00000000020BB000-memory.dmp

Download

memory/4132-521-0x0000000000C50000-0x0000000000CA5000-memory.dmp

Download

memory/4264-111-0x0000000000F10000-0x0000000000F4B000-memory.dmp

Download

memory/4952-552-0x0000029884140000-0x0000029884195000-memory.dmp

Download

memory/5728-554-0x0000000000D50000-0x0000000000DA5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads