hxxps://fleasion[.]com/

Resubmissions

12/08/2026, 10:59

260812-m3wefacb675

12/08/2026, 10:56

260812-m1zzvasvht3

Analysis

user interaction
yes
max time kernel
181s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fleasion.com/
Sample260812-m3wefacb67

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3684	Fleasion-v2.3.0-Windows.exe
4452	Fleasion-v2.3.0-Windows.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310060097883254"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{73F7562B-D34A-4100-92AD-FD1AE7691AB6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
3684	Fleasion-v2.3.0-Windows.exe
3684	Fleasion-v2.3.0-Windows.exe
3684	Fleasion-v2.3.0-Windows.exe
3684	Fleasion-v2.3.0-Windows.exe
3684	Fleasion-v2.3.0-Windows.exe
3684	Fleasion-v2.3.0-Windows.exe
4452	Fleasion-v2.3.0-Windows.exe
4452	Fleasion-v2.3.0-Windows.exe
4452	Fleasion-v2.3.0-Windows.exe
4452	Fleasion-v2.3.0-Windows.exe
4452	Fleasion-v2.3.0-Windows.exe
4452	Fleasion-v2.3.0-Windows.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4480	4292	msedge.exe	85
PID 4292 wrote to memory of 4572	4292	msedge.exe	86
PID 4292 wrote to memory of 3228	4292	msedge.exe	87
PID 4292 wrote to memory of 3228	4292	msedge.exe	87
PID 4292 wrote to memory of 3228	4292	msedge.exe	87
PID 4292 wrote to memory of 1472	4292	msedge.exe	89
PID 4292 wrote to memory of 1472	4292	msedge.exe	89
PID 4292 wrote to memory of 3340	4292	msedge.exe	90
PID 4292 wrote to memory of 3340	4292	msedge.exe	90
PID 4292 wrote to memory of 3340	4292	msedge.exe	90
PID 4292 wrote to memory of 4352	4292	msedge.exe	91
PID 4292 wrote to memory of 4352	4292	msedge.exe	91
PID 4292 wrote to memory of 4352	4292	msedge.exe	91
PID 4292 wrote to memory of 2104	4292	msedge.exe	92
PID 4292 wrote to memory of 2104	4292	msedge.exe	92
PID 4292 wrote to memory of 2104	4292	msedge.exe	92
PID 4292 wrote to memory of 3436	4292	msedge.exe	93
PID 4292 wrote to memory of 3436	4292	msedge.exe	93
PID 4292 wrote to memory of 3436	4292	msedge.exe	93
PID 4292 wrote to memory of 1780	4292	msedge.exe	98
PID 4292 wrote to memory of 1780	4292	msedge.exe	98
PID 4292 wrote to memory of 3484	4292	msedge.exe	99
PID 4292 wrote to memory of 3484	4292	msedge.exe	99
PID 4292 wrote to memory of 5012	4292	msedge.exe	101
PID 4292 wrote to memory of 3556	4292	msedge.exe	104
PID 4292 wrote to memory of 4288	4292	msedge.exe	105
PID 4292 wrote to memory of 2808	4292	msedge.exe	106
PID 4292 wrote to memory of 5060	4292	msedge.exe	113
PID 4292 wrote to memory of 5060	4292	msedge.exe	113
PID 4292 wrote to memory of 3148	4292	msedge.exe	114
PID 4292 wrote to memory of 3148	4292	msedge.exe	114
PID 4292 wrote to memory of 3148	4292	msedge.exe	114
PID 4292 wrote to memory of 3292	4292	msedge.exe	115
PID 4292 wrote to memory of 3292	4292	msedge.exe	115
PID 4292 wrote to memory of 3292	4292	msedge.exe	115
PID 4292 wrote to memory of 4032	4292	msedge.exe	116
PID 4292 wrote to memory of 4032	4292	msedge.exe	116
PID 4292 wrote to memory of 4032	4292	msedge.exe	116
PID 4292 wrote to memory of 2532	4292	msedge.exe	118
PID 4292 wrote to memory of 2532	4292	msedge.exe	118
PID 4292 wrote to memory of 1720	4292	msedge.exe	117
PID 4292 wrote to memory of 2532	4292	msedge.exe	118
PID 4292 wrote to memory of 1720	4292	msedge.exe	117
PID 4292 wrote to memory of 2088	4292	msedge.exe	119
PID 4292 wrote to memory of 2016	4292	msedge.exe	120
PID 4292 wrote to memory of 2016	4292	msedge.exe	120
PID 4292 wrote to memory of 2016	4292	msedge.exe	120
PID 4292 wrote to memory of 4424	4292	msedge.exe	122
PID 4292 wrote to memory of 4080	4292	msedge.exe	124
PID 4292 wrote to memory of 2404	4292	msedge.exe	125
PID 4292 wrote to memory of 2404	4292	msedge.exe	125
PID 4292 wrote to memory of 2404	4292	msedge.exe	125
PID 4292 wrote to memory of 4036	4292	msedge.exe	126
PID 4292 wrote to memory of 1912	4292	msedge.exe	131
PID 4292 wrote to memory of 1912	4292	msedge.exe	131
PID 4292 wrote to memory of 3048	4292	msedge.exe	132
PID 4292 wrote to memory of 3048	4292	msedge.exe	132
PID 4292 wrote to memory of 3292	4292	msedge.exe	133
PID 4292 wrote to memory of 3292	4292	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fleasion.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa448ec188,0x7ffa448ec194,0x7ffa448ec1a0
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,2526255855657361472,5334555981410730041,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,13837527137395571701,13067773364306329096,262144 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,16353762167871691226,9894122318509995194,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,16353449589102340582,7455361137623213473,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11943383698023312512,15372763356108335269,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,3413270877486117371,1392058314266487157,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,5199858295175401928,16136446325605770216,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,14485843192362185278,17886742473752499634,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,6057139888435892514,1011053991737923068,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,527335803986541247,2003432554436627442,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,527335803986541247,2003432554436627442,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,12378677920343091420,17175427317886127964,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,10811972248703601642,16210659517966653465,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15681137204627922484,1814518363421698096,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,1460943448064250282,7495673291714674291,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5320,i,12839163303038016936,1504933302189645786,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6440,i,13327433386671538884,13739986655589348815,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6532,i,1460998376884263762,16320150880801922839,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,4668208341849791876,4250662751112074211,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6560,i,6378909807542992030,6081863557350588716,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6698175239523675908,9905902233917280759,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5172,i,9800805408867637283,8867386422648890540,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,10204227002329083222,6824863939679228752,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7064,i,6764908008708957048,809325918529676729,262144 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6596,i,17284392811238121046,10887580547919657575,2097152 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,12442816866529273822,13001701836200897063,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,1119039977100486551,937088194301026079,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,6255162736102847792,16350704034009004483,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,3323462281897348762,3334458050025174280,524288 --field-trial-handle=2264,i,11363356861253353471,3731427830817323495,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3292

C:\Users\Admin\Downloads\Fleasion-2.3.0\Fleasion-v2.3.0-Windows.exe
"C:\Users\Admin\Downloads\Fleasion-2.3.0\Fleasion-v2.3.0-Windows.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3684

C:\Users\Admin\Downloads\Fleasion-2.3.0\Fleasion-v2.3.0-Windows.exe
"C:\Users\Admin\Downloads\Fleasion-2.3.0\Fleasion-v2.3.0-Windows.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dfd94c748e674ea9fd9501a156f36fe98a91bc30e4fbb7a050b3e07b6da87251
MD5 48d2a74b9f9b337cd4d5ba5e79dfdd84
SHA1 6ba022dce5af70c1a5595b902b4e5bce7ba7ee3e
SHA512 26bb29893c5ff0f3c85dcbf16f331db1f6ab01b4ae8d6d9c68be344cab219d9861e101be415b454fea0375470c85b7e982f35351ad4c64e248be7c2bad9702e1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 4.0MB
SHA256 3ff7a8f5b23f8d5d757a660a1fe2f03baec66bde0f6941ad76edf7ce273f2f2f
MD5 eb31b7620afd4339411e74d5494d6352
SHA1 b40868f0b84a6999429135cb9c47a0fe1cf66d8b
SHA512 16bed8427dc1e97f5347e55290766d6246c2c873285a229bf4d63c0b0f82a73a9fb9f596cd312c123d8d7b194719ece69603c8d073fd3a87136bf85f41d9f547
SSDEEP 98304:23zygul8PAORoGG6tV/45TA9BbFEqogl9rXJcPAOX8orTqDA7:232gueAlGXjt9HcCwtJ
TLSH
T1AE1633A4D66D6300EC0B9F7466DA53407EF1C5DDC9D27912A5FC823E0DCA8A2BD37066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 53e7c2cdc5d12cea2a39c152ba7493d501ebaf9cc55d7358dd736afbde514f14
MD5 99dbe5be92a9a295d3904202de219f26
SHA1 2da9fbed6c4639764bb2ed22c92247fdf7e592d1
SHA512 0f42da897069cbe1f2e2a2b19331abf149f2175ce7e8b04905cb59bc0dfe8a3f81fa998c5dd6c46c219520bb470bf82107412975dfe396874b1e1b56b2cbc7e4
TLSH
T1B3710C590E05549DEFD71631D5D123B83AB4B3978E8FBE59421CC8BD6A35F3286C604C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58629d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58629d.TMP
Size 3KB
SHA256 f2cd7cf6d1e4cb10290b89a55dceae913235b36f291d0f8c240f918186b2f136
MD5 868d3e5bb51e0c73848da1e1559510e3
SHA1 f7d6076d54843c1d6fb361c48f993a0df4c80d97
SHA512 1d742a8062d889d8c8bc57d77f3ff1aaf11eca68e0f67953f72b1d655842e6b7e1f293052e6a3b1515eb9aadc922d72e0b456a625d2b5911939bf952ab19a021
TLSH
T1E861F9190E05549DEFD31631E5D123B93AB4B3978E8FBE56821CC8BE6A35F3246C600C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3fd0daac3dfd7f0f48af93cf64a66e1ea729dbefaa6086434d27b21b0492276a
MD5 af791b77ecad0d474b6648124db3268d
SHA1 568e18be60175db26de268f50121129c71c7de2a
SHA512 140efa0c595e9442910c92ccc763bdbf154dc61ae8b7741e36f0f73628bb5d07ebca0902bbd7dfec1389059c0c9ffe5757bc3371419122873834b611aac24f1a
TLSH
T19A516DF7C7E5852D8D2156F4AA156E1FCE5D092443183C2AC9D4AF1BA3E2471E141B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4fb75e80b313ecaf3873ab75bb8d6dc09ec1cad54a975ab3922e0cafc53f2392
MD5 8e93e27ac982ddf082188c6c15801e90
SHA1 8e4a1d63f613737c5c310b6d01b1d8c6f7b4485b
SHA512 36366f51e300cb68e8cc5e145e62906b52b9b424b80af824804418baf554898ba1285ab544d56e5ab7fd4d99fb32b759a68737c46b8cb3bafd406500a1a1bf75
TLSH
T1AA316DF783F5992D8D2152F0EA156E2BCE2D0915432C382AC9D4AF2BA3E2470D544E4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9b43e2c08ce41547330cc307f6c74020e38d27a5fb5b9f7f021ce130e4676088
MD5 7e15af4ac66daa0f11d11a4ca540367a
SHA1 b1d1dcbee702bd0e7e26942269e848ee8f0f46e6
SHA512 e5c29aa974bb7867caceb5fc03d4c58fd07d92847cfa53012f645372a6b81a5264f42fa5a06d06951470121df28e19d9cf7b67b062c2f69b890b817da411510f
SSDEEP 192:sxZyRYyM/jK1Ml8MkG/fxsOqAIdpZaHW6+WNu0b/YHNbpBIgrJ:sxZyWMG/fxsOqBoHbl/g9
TLSH
T1D552F8156A34A977CCDBD209F945BF93D7F50472A6901E44AEFCCA1C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6a1a756b4fd5523153b6c772a91f6b886e0f1069276ce5893e165e4b8470aa11
MD5 3561afb4a1c5cba4bdc567543185a59c
SHA1 fa64cf83d749ceab30123086856e821c984eaa67
SHA512 f2b404ae87b462b2b3980552dd42ef1341ad715b0fca44568a3ec58520800707212313ce4f0f98d07a47dbda62ac517c30ebe00f62a0ae811b3eb454b93ab17f
SSDEEP 192:sxZyRYyM/jK1Ml8M9G/fxsnmYIdpYRQwHW6+WNuboVYH7ZWBIg59J:sxZyW1G/fxsnmpNwHbBVNp
TLSH
T1FA52C716AA346977CCDBD209B955BF93D7F50472A6900E44AEFCCA1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3e1487681c4cb6bdecb9ca90e12d5440560b9b0e1dfda86dcb40480b0ea35274
MD5 7749dea29c4faf91bd12354ace1ce92c
SHA1 8569863fb92e174b19dd1c1324bbf9e7e9a5e8c5
SHA512 06a9dfe5c4d6e897f05a68e67cc6d7bb3697e3e01b490f4f033ac39204c84a8715e307f7e55d355749225f1ec059ec6372aa8c1e5bee82de801ba60a1652faeb
SSDEEP 192:sxZyRYyM/jK1Ml8UQF89G/fxsnmYIdpYRQwHW6+WNuboVYH7ZWBIg59J:sxZyWqoG/fxsnmpNwHbBVNp
TLSH
T16F52D816AA34A977CCDBD209B955BF93D7F5047296900E44AEFCCA1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 295a9d21bad233b2f6d62ca9499504a5c7365bfcb999e57cb8b9c93a9043cb2f
MD5 7cdc851826a990f35d9909bf35b4060c
SHA1 a7b2b32f1b00f1790ba1646ffad83b9fabf5dbd8
SHA512 2caa2b6e0a1a2261427616a0ba9273d0e726edc4dedb836c7e18d422bb68e861c08afcef0d239cbd4c5d728794d25d6e0f34613b5170cc475e98aa254b35f1f7
SSDEEP 768:XqUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R8roVf0v:XqUZYTMWvg0Pou1ja7eLZmRnav
TLSH
T18AD20A3B284CCB7E4F844E5DEC266F963ED801CB5A584D5447EA884C02CB3EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 658da5910ce40af7fabd1c84f7b6045b59d43b3bafffcdbe77b93ef5a41fa489
MD5 c86721da6f1e63c0d4fb6c792e52e91a
SHA1 bfaf5d3b229866b18328d9751680316f71705f6d
SHA512 458df5a0a9b880126e880c5ce0a418690d8cd4fa9383319cf5c35d2fea225e107fffb49dac2f18dcf88bbe330a7ca56f0b1d77ab1096929c9e1ab3b4223b5bea
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU04:ES3D2rZB
TLSH
T109D1140272BB02033C3D6918A29A97774F85F1E33454E82B7BA854B64D66E741CFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c963b78e6fd1dfd09ed259c3a51368e982d0586eb15139394c2871531be8aac3
MD5 987c6cfbdc819bb51b899ff0102fa2aa
SHA1 063c65ac54bcaa0c4aad6cd14cb91b7158ef0a11
SHA512 cf568b983744b4524607902d4f9ddceee82539da61e5cfd734961b983b27cf8f02a232e6a07648266235aa79d3d942d08f5033350c18fc7eec87de5a32319428
SSDEEP 384:XJZcIU7XsNjpvyLl93EP2zX5od+2OU99NCMsRnlYJT:x8Xa22qOTOUvNChn2B
TLSH
T175A27C32AD686C379DF6F586F88732134FF46067E6C46F8496DCAB1C01DA6AC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 eaf8801f8641fec93536dca88057c05b9cfcc82275fb1b6ba4abbf3a5a3c7ffe
MD5 c4d30f54be7ce54b1b7717fae923ed7a
SHA1 c72bdb87749e53e81b86695ffe668e75f3d1636a
SHA512 64c3a0918b1846de385552f88137f72daba8fa6eaa264cd8b22b1a68b0d1bbc96903056e793d19eead4e9b7bc8deb953d930604e27e1b27d9dae1cfd43f68575
SSDEEP 384:XqZcIUzsNO1vyLlb3EP2zX5od+2OU9INCMsRnlYJT:4o/o2qOTOUuNChn2B
TLSH
T1AD928C32AC686C379DF6F586F88736134FF46067E6C4AF8496DCAB1C01D95AC1306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd083139c8e90e37c6d83f541ab0f5ef9de6865d01561acab4e1c8344160642c
MD5 450db91a4c23cb9d8326ae7e7ce85e00
SHA1 27f9bde8d47cb6d2c32dd1d8d911287e61ba36c7
SHA512 346fdfdad79acc322215b3298b2f7f6aac29f03bc1f0ddfd5e88bc74be4bd7d5d2d5a49cc0022110a07f8e31d985ffdad43760917c1559e86c8aba77121cddf5
SSDEEP 192:dON361UWQmiUyXhPGX5Obd+jKOImy92jJtqCCU6:dON36FKPGX5od+2OU9SNCU6
TLSH
T14B12E9326968AC779EE2B585F48736535FA55167EA847FC0C2DC2B2C01DF6AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 28a5b4e23c74c6bf95594fdbb907ef681d57351ebf9c93203e9372169b208c06
MD5 dc9422947086b5b97234987e70c71e10
SHA1 b5d0c6898aa3c12567f3314744cb20e294b6f2c4
SHA512 63c4e6a515b74cadd93a054a4b48270bc6d1281303fd79472de85f872c583b5d092caf9b0f194739ed56495ac293ada75d21bfa5aca63f470e9f4ddcb52b0658
SSDEEP 384:mZcIhsNOKvyLlbSEuzX5od+2OU9iNCMsRnlYJT:0hMBlOTOU0NChn2B
TLSH
T10F927C32AD782C37ADF6F586F88736134FF49067E6C46F8496DCAB1C01D96A81306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d50e4160c184108a7938c4b9b42a0310b10054382d25f5f556d98321a295ae1
MD5 489070576c1813fa7044aac1ac8de232
SHA1 39060ab51ab25c97e7778f2a702f868bda7811e0
SHA512 8ebab226ec06dfb8df1646d7f5b22cf23c85c907fa1a1ec9b39414109f30737fbff971e82e19199498dc0d0553a3772881a7ef412c1c61c2d970a8a3efbc6376
SSDEEP 192:yON061VWQmiUyMhgGX5Obd+jKOImm/aJ3GFU6:yON06WXgGX5od+2OT0FU6
TLSH
T13602D73569287CA79EB2BE49F58737135FA8207BEA546F84D6E81B1C00D769C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 17b993b834f0cbea5f5be9cc34c5ad000072995405cbbcca0b96cbc96f251919
MD5 0137ce4f321090898d8ad77634169f67
SHA1 022f600a1c293bef84453d88ec9e315de4758a2a
SHA512 977f1287d850d7cb653cf46fe236fec07ac3e47d53b774213495be2770e017459f48f9118fad7b5086bea48dc8c580e7a99cef29a6b7da4450c2f2a9d2b855b4
SSDEEP 384:dZcIhsNO1vyLlbSEuzX5od+2OU9iNCMsRnlYJT:Fh/BlOTOU0NChn2B
TLSH
T1E5928D32AD782C379DF6F586F88736134FF45067E6C46F8096DCAB1C01D95A81306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6a6dc6881688b6afa3bc399cff02a2b6872521395fee79d6b317661505e5e01c
MD5 dca1100a792b36f5cbb6953816f0fb1f
SHA1 2c40a66be96886edaa677e5114d6e8e44b0d8817
SHA512 e0a6c0bb87d50f1eb639a24b396bd193110d2ac737f5fad6551f2849bfbd348215a448fb1680953c6315cd3de85b1285036137c61a733eb0af66a60db418e930
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe591c48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591c48.TMP
Size 392B
SHA256 0bc16312ac3d648ca9f3336b2ea8161f32e98328b7053bf6c84fb0d5a1c3efec
MD5 dd53b2879a63a49fc90f3ee286800f66
SHA1 e8a72ad34c9e7dc3e64a7c92a20ffb3a9b744533
SHA512 4064d2de69ebc068861c245fa51a0d087f46c20348ca38ead69104f53ceee4e8486fd772a5be621890bff5278eb30d775be75b7ba46542d37db168c1d505630e
MD5 SHA1 SHA512

Submit Download

6f85bf1e-1c0d-47b2-8c69-2422e844bb76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f85bf1e-1c0d-47b2-8c69-2422e844bb76.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cfe21da3133f05db149c01ca30eba74e7f097e29d3fb84606eb24cca687010b5
MD5 a2cf8cfc221cc4c588c2c37599af9b32
SHA1 81c6a66f04c15cd21fb2dc527ae65ed46f73b59b
SHA512 121ede5142f8a91453283aa8583f7ca8f8b06ae85e6b23453be4fdf827a777da296000f7afe13c7a77b9b67640cf4d8a82453ecaec372d63869568704b563b51
TLSH
T1D7410798B6EA0148B3B67F5AABF6686D987E79773F06D05E00010E4F0A22B41C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3684-379-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/3684-380-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/3684-381-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/3684-382-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/4452-383-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/4452-384-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/4452-385-0x0000000190000000-0x00000001901DC000-memory.dmp

Download

memory/4452-387-0x0000000190000000-0x00000001901DC000-memory.dmp

Download