6956edf885b4a96ab4a19eb385a8c9174348d48d6a59fdfcfd7f8bd09d416a1f

Analysis

user interaction
yes
max time kernel
86s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set up School PCs Installer.exe
Size 796KB
Sample260908-tafa3stsgz
SHA256 6956edf885b4a96ab4a19eb385a8c9174348d48d6a59fdfcfd7f8bd09d416a1f
MD5 84fcc45a04724ea3cef9664fa4bda64e
SHA1 95945f8735ea4c4628398fe501c637aca67a18f6
SHA512 5b3d58f94fb99a3dda5be610ba67b6b6f822a05eb6ab3bbdedb61fdb2b54c2d8ff5ab973a489bad050171b348609761012315767e0794cbbefcee5d3248ab6b0
SSDEEP 12288:hDVL+7JSjDPQ9khNcp3IjE/Y5C9+Xy34lYhOsfzGP3c:+7WIAcpYjgY492y3wMO06P3c
TLSH
T11E05AE906BF84019E7BF5F76B4B248168B75F903A8B9E7AE4794509E2CE13038D24377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
87	3124	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
2296	Set up School PCs Installer.exe
1912	Set up School PCs Installer.exe
6436	Set up School PCs Installer.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4364	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333562944649253"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{7FB9ACC3-47DA-4B55-B29C-51A3D8A08E19}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4868	sdiagnhost.exe
4868	sdiagnhost.exe
6788	sdiagnhost.exe
6788	sdiagnhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6076	Set up School PCs Installer.exe
Token: SeDebugPrivilege	1912	Set up School PCs Installer.exe
Token: SeDebugPrivilege	6436	Set up School PCs Installer.exe
Token: SeDebugPrivilege	4868	sdiagnhost.exe
Token: SeBackupPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe
Token: SeSecurityPrivilege	4868	sdiagnhost.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
2720	msdt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 1308	6076	Set up School PCs Installer.exe	90
PID 1308 wrote to memory of 5900	1308	msedge.exe	91
PID 1308 wrote to memory of 3124	1308	msedge.exe	94
PID 1308 wrote to memory of 2704	1308	msedge.exe	93
PID 1308 wrote to memory of 2704	1308	msedge.exe	93
PID 1308 wrote to memory of 2704	1308	msedge.exe	93
PID 1308 wrote to memory of 2436	1308	msedge.exe	95
PID 1308 wrote to memory of 2436	1308	msedge.exe	95
PID 1308 wrote to memory of 2952	1308	msedge.exe	96
PID 1308 wrote to memory of 2952	1308	msedge.exe	96
PID 1308 wrote to memory of 2952	1308	msedge.exe	96
PID 1308 wrote to memory of 3484	1308	msedge.exe	97
PID 1308 wrote to memory of 3484	1308	msedge.exe	97
PID 1308 wrote to memory of 3484	1308	msedge.exe	97
PID 1308 wrote to memory of 3972	1308	msedge.exe	98
PID 1308 wrote to memory of 5684	1308	msedge.exe	99
PID 1308 wrote to memory of 3972	1308	msedge.exe	98
PID 1308 wrote to memory of 3972	1308	msedge.exe	98
PID 1308 wrote to memory of 5684	1308	msedge.exe	99
PID 1308 wrote to memory of 5684	1308	msedge.exe	99
PID 1308 wrote to memory of 5412	1308	msedge.exe	120
PID 1308 wrote to memory of 5412	1308	msedge.exe	120
PID 1308 wrote to memory of 3108	1308	msedge.exe	102
PID 1308 wrote to memory of 3108	1308	msedge.exe	102
PID 1308 wrote to memory of 6020	1308	msedge.exe	103
PID 1308 wrote to memory of 6020	1308	msedge.exe	103
PID 1308 wrote to memory of 3964	1308	msedge.exe	106
PID 1308 wrote to memory of 5308	1308	msedge.exe	105
PID 1308 wrote to memory of 3148	1308	msedge.exe	107
PID 1308 wrote to memory of 3964	1308	msedge.exe	106
PID 1308 wrote to memory of 3964	1308	msedge.exe	106
PID 1308 wrote to memory of 5308	1308	msedge.exe	105
PID 1308 wrote to memory of 2340	1308	msedge.exe	108
PID 1308 wrote to memory of 2340	1308	msedge.exe	108
PID 1308 wrote to memory of 776	1308	msedge.exe	110
PID 1308 wrote to memory of 3676	1308	msedge.exe	112
PID 1308 wrote to memory of 3676	1308	msedge.exe	112
PID 1308 wrote to memory of 3116	1308	msedge.exe	113
PID 1308 wrote to memory of 3116	1308	msedge.exe	113
PID 1308 wrote to memory of 2296	1308	msedge.exe	115
PID 1308 wrote to memory of 1912	1308	msedge.exe	116
PID 1912 wrote to memory of 1632	1912	Set up School PCs Installer.exe	119
PID 1308 wrote to memory of 5412	1308	msedge.exe	135
PID 1308 wrote to memory of 5412	1308	msedge.exe	135
PID 1308 wrote to memory of 5412	1308	msedge.exe	135
PID 1308 wrote to memory of 6236	1308	msedge.exe	121
PID 1308 wrote to memory of 6236	1308	msedge.exe	121
PID 1308 wrote to memory of 6236	1308	msedge.exe	121
PID 1308 wrote to memory of 7020	1308	msedge.exe	123
PID 1308 wrote to memory of 7028	1308	msedge.exe	124
PID 1308 wrote to memory of 7036	1308	msedge.exe	125
PID 6436 wrote to memory of 2796	6436	Set up School PCs Installer.exe	126
PID 1308 wrote to memory of 5344	1308	msedge.exe	127
PID 1308 wrote to memory of 5344	1308	msedge.exe	127
PID 1308 wrote to memory of 5344	1308	msedge.exe	127
PID 1308 wrote to memory of 3736	1308	msedge.exe	128
PID 1308 wrote to memory of 3736	1308	msedge.exe	128
PID 1308 wrote to memory of 3736	1308	msedge.exe	128
PID 1308 wrote to memory of 3952	1308	msedge.exe	129
PID 1308 wrote to memory of 3952	1308	msedge.exe	129
PID 1308 wrote to memory of 3952	1308	msedge.exe	129
PID 1308 wrote to memory of 5176	1308	msedge.exe	130
PID 1308 wrote to memory of 5176	1308	msedge.exe	130
PID 1308 wrote to memory of 5176	1308	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Set up School PCs Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Set up School PCs Installer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NBLGGH4LS40?ocid=&referrer=psi
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ffe626ac188,0x7ffe626ac194,0x7ffe626ac1a0
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,17206579029904638892,9747947714219270267,262144 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:2
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,5682194855273262094,7770584726097733088,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,10324829820346016186,16464876705395775643,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,16577110278743512433,16788720535328018476,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,8771704604951062736,4011706968998721261,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,11279775579040309360,10744781215507142302,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,6668051587121020076,15618150916293166507,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,10307620473098686291,1885205899663086344,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,11818816148693840884,16099390724032244097,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,5289759604896750810,18086050531370403203,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13632760710269967615,18252935269755758827,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,17842630627895852533,2859101837373863558,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6196,i,13912834866690291082,10263635926126605669,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,6611656184891985288,3373335757231676495,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,2006230510819200560,5817985739698283818,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13632760710269967615,18252935269755758827,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,3536009189673537014,9257104167905150876,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,6948201641152678274,10354308923842861072,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:3116
- - C:\Users\Admin\Downloads\Set up School PCs Installer.exe
    "C:\Users\Admin\Downloads\Set up School PCs Installer.exe"
    3⤵
    - Executes dropped EXE
    PID:2296
- - C:\Users\Admin\Downloads\Set up School PCs Installer.exe
    "C:\Users\Admin\Downloads\Set up School PCs Installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NBLGGH4LS40?ocid=&referrer=psi
      4⤵
      PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4740,i,6087699173257609826,18165739604397721098,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6892,i,1806817533395745496,628392563164271847,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,5127749063508333365,7696064697838147544,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,11342721963947530379,14496014894576431417,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,14208554390871134354,17536588502162597546,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4904,i,5719115427712535211,3607651100323700713,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=2496,i,16733747518580089632,3863817802034767000,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7612,i,10384928596203018024,5203504174934729156,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6852,i,15419756684335081263,12164559607719384786,2097152 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,10513272838182058394,9216652102776214975,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,16410702914484881332,14850964927221380235,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:14
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,11932892578813502900,3476314986445954663,524288 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:14
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7536,i,10416770216706923353,9197469401774146809,262144 --field-trial-handle=2888,i,1313873896913207289,8408479226623257801,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:10
    3⤵
    PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1184

C:\Users\Admin\Downloads\Set up School PCs Installer.exe
"C:\Users\Admin\Downloads\Set up School PCs Installer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NBLGGH4LS40?ocid=&referrer=psi
  2⤵
  PID:2796

C:\Windows\system32\msdt.exe
"C:\Windows\system32\msdt.exe" -id AppsDiagnostic -ep CortanaSearch
1⤵
- Suspicious use of FindShellTrayWindow
PID:2720

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6788
- C:\Windows\system32\sfc.exe
  "C:\Windows\system32\sfc.exe" /scanfile=C:\Windows\system32\Qmgr.dll
  2⤵
  PID:5216
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sdshow bits
  2⤵
  - Launches sc.exe
  PID:4364
- C:\Windows\system32\bitsadmin.exe
  "C:\Windows\system32\bitsadmin.exe" /reset /allusers
  2⤵
  PID:1180
- C:\Windows\system32\net.exe
  "C:\Windows\system32\net.exe" start bits
  2⤵
  PID:6232
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start bits
    3⤵
    PID:6412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:7120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD
Size 312B
SHA256 c6c6296e5befab3d65d60f99b7dd498890ab8d70114fb013ef49e35480122385
MD5 6a8a54acdf7c5e2f449cfea030aebd67
SHA1 42a9b43c80c901230bcdeae546f2157f535f3884
SHA512 0de20df2f16bb117c0254581a574563d83e2baf68e575864621913ad640412f6fb868bd8673a406cbb38de02d0cf177578c9d8e4292857edaf2a0ab87f8b4eab
TLSH
T1DBE0CD4576F16C002D714841FFF5CD79B570219B248364486827159244B762F5A23106
MD5 SHA1 SHA512 TLSH

Submit Download

892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
Size 951B
SHA256 75484330e8c487492e9394bfb913de4f47dab02067142b85ee870b0a05d9d295
MD5 2459d86df526fcff32e990f506c34e41
SHA1 1abfb35d5cda708929935b92354548201584d2ac
SHA512 c7c8945319b907b2e9c3973f9eb4a3657fbb6972cda077810890d6fbe02b692ae285eaac8e546450fff42ef8b61049d17ef77be79e3800aaf663ab33b3856433
TLSH
T1F31194096C3891C1DE72A21BF2D8CC233C70418339C89687A049DACE035F394AF14A8D
MD5 SHA1 SHA512 TLSH

Submit Download

26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD
Size 404B
SHA256 a8cdae3c82322401e49824efc0cfeded458127b04f8d30ff4bc39f9a7a52f748
MD5 9ff9969b4264e2280e4e5ab7db08fb8f
SHA1 5b5f40969137526b9d9429cd12e3f1de83afefc1
SHA512 93a6a2e09303df3df197d3d549d58a4325f7db407b0bf36a69ec86b8f56a86bc66e1548557577cd3773e2951eb92e4911913aa7b4064e1df6860a5bdb5bea616
TLSH
T159E020303BF6405CE070B578C6D59F25493EE0350844C7751BA4254A6E076416D32D75
MD5 SHA1 SHA512 TLSH

Submit Download

892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6
Size 438B
SHA256 db620797895c2b5626d10aa4fdced16bcd7ae0736addda7bfa10e70f67021c22
MD5 15d4d375bd72397d8f7bccd6a01ed63b
SHA1 c9595716abbc026bd262e6b599a0711a6e408d93
SHA512 6d19393331e758ec138d3f94778ed6505dccf6f9249dfe518de8f3aaabccd45df2b34c4ad6704cc5eed6d9de0bdcb8550401ed13c59126b724b523d4ecba55a7
TLSH
T1A9F0682C42FE4119F332C93603CA68AC697DE0230808ABB546D04725BA39D002EA7B23
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 54KB
SHA256 38c4aa45ff0c8ca4b67710108d794af80cdada3bd3a9b83b51a23ee20e02c7af
MD5 67c7a237335140f3868b216a59d08cfb
SHA1 e7dafa609f356dd80ca5d612effe0f91beb9d349
SHA512 ca2b638bdcc95a175d5c6710dc16aaad269476c02ae333c443fcac9f12c4c1e08969158694db9deb3531c8957611db767cb1a5d9ddb680c5674759ea0224ea46
SSDEEP 768:ZB3tqOA6nS2KeACYVrbU4rBDSe16WqzO6WX6zvZDrBs8++XVFlZ7+:Xdqq/Apg+b16WqzO+zvZDin+z6
TLSH
T1E943022C123C297F763F2CBE7811D2610D0DB14B3035529513FE95EBA96AF43506ABB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 276KB
SHA256 80793fd062e283e91a5081859fbeffcf92714111236d6712ebb162e20c0699d7
MD5 7cf91be8566a2576a6e9688193b5ab9b
SHA1 8abcbe03d6f0d2619a340641f032c3a01f3f52bc
SHA512 0759b83c86ee1d5fdbad9e954c7672194efaaef343723f518533d834712418886b4b0677477204f37cdf0e0b5400c8f48c437e67d1039efc9797fa474bd424d8
SSDEEP 6144:0V9lPvtEIJuopV9WzgP80d77NjIZ3IZt0wS+1TF8IZKF+QP:0V9lPeIJuAG0d77NjIZ3IZt0Zce3F+m
TLSH
T1B3546DBFF7C4306D02071347B945B739B62D0639B2A1D5C6A888E53E11D1FE5C42ABBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 66KB
SHA256 810b25973355861bf98b680fa0daf47f2a3d2005e9e5d5b3b9590805a4cb4736
MD5 638b5e9d768fa5870d04a535604ef1f8
SHA1 23cc624e1522b999987ea3893cea4d5a34aa6726
SHA512 5e8f75af091325aa8debec7ad2a4aeef9430d9d914bead1cd87ad9f8f976896a070a7b45c73825cdd79a157a0ba1bfc53158f1932f8d399cabdfbe27289ded37
SSDEEP 1536:frTENi1zJEmmlo/JVxuPID79AIvra2W1ho5JQ8LTmtVaa1leapeX:frqi1z5mlYxnAIvq1CCImtda
TLSH
T1DA63022D0FDF81ADE960C69446D540F4EE98B732A138EF87D0A08F39C8D795732524AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 67KB
SHA256 c3aabef9e8d36c5c67a6ae5ba7b5e207ab891510810f3cfd1bcd1a0331c444ac
MD5 1b1541128689672c785a0800493c79d2
SHA1 65ee82c4fa70f59f4e85a97023d1cb8da060b7b5
SHA512 3e1ad346361330574386a37628951bdad4ecc67e0b7e723a92c2308a58af042485f2abe3e8354cbf6f2daae12edde10296d9e1d814bd93b05d7f49f95089ee81
SSDEEP 1536:DH0o0C01DtqK+6fkLPV/d+NcMz1ZyqHjJxzg5TOEM9vEADL5:r3zMDXfoOc2ySzKKP9vE6
TLSH
T1E26302F1C70F213E92556C28D73C408207C9761B72A661B72069E23A85C97FF72A977D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 54KB
SHA256 9ab2f2403c3ef2cbcb4e76e8881170bd82788d31dcebccc376dbe16f5f211741
MD5 66587846cf9db451c2c1211ccc4bc819
SHA1 15ee6d3ad569fe3d125500f509e99a14e10ba155
SHA512 a03eb7622e62ee71521e1946d599aa507b3c0625ffa77cdbbe3b448c8d2197afb64a48a80ec954eba49595c52b09c0714488f582a0967288c904622816c3a258
SSDEEP 1536:6pTILZ1nyPDTtHJWW4/iaCZ5Krry2iWjCdU4:GTIFtyPf84Z5KrUWjCC4
TLSH
T121430288DD1E1F8B50B3436344466CE9382FC3F69767926F3925535B2D193E9A09B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 24KB
SHA256 c7f1ab381d3c6f0c52968d2d14278c0b107b53a5e154b7381d2a46590e7d33f0
MD5 8b62cb77af08af8a3c92a15d0534ad07
SHA1 a7d15c6d6a8177b229297c54df57bd344b794513
SHA512 3ecf677f8eff0dfd5920b9d2ab8b8de21f7eee62ab429a033b0fae624a6a88718e595a81bfb5dac841f1d67bef8f0d786ba57a5096327cf959689dcecd16a823
SSDEEP 384:ziHP8fq520czx05WRFDagKW0LGE5zX9twpBqNuCxQSBx7eh9nAj751HDdg8Y:zcEfmY02FDagn0n5rbwvCCCo9o51+R
TLSH
T151B2E17C040ADC4CF924AD5E751C3B7B29349AB31FB4A499841A1F09612A0EE1ECB1B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cab1fca9f8a2010c1d1a0fa43ac352491f0a45cd05d56805bedd887c12526d0f
MD5 c86375ec0616ee24115bd3d28c3c5ea5
SHA1 ce272fa391e5b50008b7fad436faeb83b445d87e
SHA512 9a7eadb2c7d74dfdfd0f61afe997fddde6a9c56ec7fc869e62bdbb53c72b4f544d2e829e1830fd061b1971b87b7dbd733b4eb593ad2ab5461077ccc49a15ec65
SSDEEP 48:dHR/HAcOk57ojEKQopO8B/TJ6LbmuWa/hVPu0/lGiDHM/YA/sKbfoteh8Fn2f0LB:dxYmkjEKFRVMuuDh7DtAjovR2+CP52rd
TLSH
T19991C96E532D8881CB1442B513E316F6B9F2780B0D2B7F058650FC34E981FAF65E0993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bd17fea7d9999766ee792ae2955923411d7d92495d180066045055ed0361bd6e
MD5 50384eda46eaa1c92c589e1ab0ddb56a
SHA1 99a39050028d6aef9034751550c4ab2304dfe2c9
SHA512 faed23d742ceb63bab9ed5be75a8ed75551c56690266e7d7cb3e7ac91fdc0929202e93cde3f7a3b72e9c069ae0437485511fe13759316eaa264f3696ec363b94
TLSH
T1F6519EF787B4856E8A1196F09A18AF2FDF2C0615435C7C6989D4EE27D3E3472E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3b7efb5ced230abda8493803096bb0a646415ac9bc8e79d23012e3fbbc6488e0
MD5 68b34431511477a051f4774f9c63959e
SHA1 c31381f01e68b5a256a4d954e787b9c714b1f11e
SHA512 235ed4070fee0005960fcf48fa66c66969f3657fb55ba0a23efd15c2ad701dfda8410c5a1d69d7bc92b2a2c08fa7466b7948207c8f1dcbf67bcc6b9dc17b06f7
SSDEEP 192:sxRVR/TY/f8sYdwGczoA8p9v/g6+WN/dV/Yo+CYPGwIgVfvJ:sxRVRY/f8sYdpNR/5//1mv
TLSH
T1E442A8166D28A93B9CC7E21DFB65BF53D2F91032A1D06F48A6FC861C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7089221e6a202309cafe9320f1a98cd1bd781c4208f3583f218f44d53a67d44b
MD5 ec579e3235ffc82356b1527619f15cdc
SHA1 ad781a51b7add6b351edcc357dc3edfbd7b04bda
SHA512 11b386b12248ccf39db00f89b1aaa30c15be144a8d7759cc500c87fc5b1e118ec5d4106fa1ceb8e75ccc642493f6c1bdfc846cfe16200932a5ffbe92e949cef5
SSDEEP 192:sxRuR/TY/f8sCdWZ5qG0zoA8p9v/g6+WN/dV/YomOUzYPGwIgDmf7J:sxRuRY/f8sCdg5vVR/5//AmK
TLSH
T18042B615AE28A93B5CC7D20DBB5ABF53D6F91033A1D06F48A6FC8A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 946d86376dbcbb95f8dbd2df951b154479b1eb20e1ff0614bd08058b5323df99
MD5 4ea9cf9b49f1f7009567fe9054f2792e
SHA1 4cea925ab4717703416495d4b50bd0104a672037
SHA512 b358120fad3fa66a047fd7154501c8d3e15ee19f701dc69b0355bd9572f32189073168ae283170b5f446a63b0365932a8f569ab6f9d10290154f8ada7f060970
SSDEEP 192:sxRuR/TY/f8sCaWZ5qGSzoA8p90q/g6+WN/dSZ1Pq0fB9MUzYPGwIgDcf7J:sxRuRY/f8sCag5vfd/5QZhm8
TLSH
T1D942A815AD28A93B9CC7D219FA55BF53E2F92033A1915F48A6FC8A1C04E77DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 21ee0778b5f9579a244ccb98b6857cc0e0c58717f8eda53ea5f7861038131040
MD5 73b4844ed34dcf3b43ed8e5d91e1fada
SHA1 f2b54526c0bf467d19921c422e6e8908829c5171
SHA512 aa003a1f39760bdf109b79477c7b8f8fb1dcc6dca75a19dbf92e0753ef11ea06f7b32fae45757258bb53741aea943d5bbcd11cb8a1eda2c2a3af1c378c1b7a5a
SSDEEP 768:j26Hzo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVOVuw2ro9d1e0Ul:j26HzUE7MRWgs2f02u1jap4wNruB
TLSH
T1B2C2DA6B640CCFBF4F800ADDED197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\9f2de1eb-236a-48e6-bd65-82a7c5170864\index-dir\the-real-index
Size 3KB
SHA256 16a765724ba78430d962fb98f3352df867ea1cfb989168820ebdd4e59ca1cb36
MD5 d95397549bcd1a8fd5a867544dabbbf0
SHA1 b8edd729c7178729da4a953b31702b1444b7d353
SHA512 1d7e6180aead6e3d05539a010f06a4d02d39a3be14c7dce9a6a62dff5a0a62de3b1a4e3d030ed0529f91727316fba93ad5b9a82390b853c313a9b474221d6ca0
TLSH
T1CE81B7457C82FE34C7C608334170959EBF7169DD6A4C7E0900EE9AE59BE32092E96459
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7f14.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\9f2de1eb-236a-48e6-bd65-82a7c5170864\index-dir\the-real-index~RFe5a7f14.TMP
Size 48B
SHA256 e5d36ab22ba9282a7caa7b5eb1def75e13af82b8bbc5864adef2be4de37911d5
MD5 12c5fbb6c5cedf9617d82764161fc23b
SHA1 f4275b93a1e1b06f576ab145c436c2f089ecd9a8
SHA512 182c9284ce4826d971b39e32ec3150204b6467df4e90716bf2058405b401a34efb34c2bbf1e762f3979163db65d4294588f824b7ee108533141192b917d131cc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\a0e7c610-ba45-492f-89ae-01c1d3026565\index-dir\the-real-index
Size 72B
SHA256 77cd9ebeefee2c2af75a085f92981fb9034275c92c791150979107ad97b9b43a
MD5 23b5fad8e4f023d3d97ca1098843caff
SHA1 552344bb1172dce81182928657a92bb5d49365c3
SHA512 f8701d5931a6ffcb357921d43b5d8be5f6b7fb506a2f44b59278fa6b230d8fc72d0364c55edff77b0be6dd7e9783647e41a405da2247ee0ce5577d24c769d17d
TLSH
T15AA002609E468025D042CBB5907319CE63514C9A4305130258A5808C8954A408116071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\a0e7c610-ba45-492f-89ae-01c1d3026565\index-dir\the-real-index~RFe5a5277.TMP
Size 48B
SHA256 572a01b105ce491ef653c9ecd0ec175d60e54359c36372b0a31268207c1f9b4b
MD5 75849844d62394162f58ab563f658d7b
SHA1 3a1f9957e77f6aa50fdff1297da3c57d5f4abafc
SHA512 61984985d5a244ea417d710752c6505e8024e1fdf868360478dc3efcb32e2e9c7db021c9c2971bbe3be56f66f10d5c1c4e47ad8c96da46e3ef219743acf58664
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 7263a0fb9d6f6f0483a56ebb80e30d665b607deed2ca3c5ac1b07b6a6178eb5a
MD5 48d269833996e7dedd1428c7365c2fdb
SHA1 906a877b49c7ffaeb6bd16e09b9c9fe9d58527c2
SHA512 ac4b2c7a49286d92f7ae473d78b16e39cb2130307e1bd13062b95d06ced74a0636f803f2134d559fe5d0a6530c7bc5aa2cd4d3ba54618acc3974ef07daff9ec9
TLSH
T1CEE061513673521297B114DD0DD4F39CDC3F3E435D50CF144084B1020CBAB568552F53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 5069131e5b94847787ce6e706b044b981fafc5c2be818f6b0cd722716c279f07
MD5 b8b857b09c6d1409a2f986f17d34002b
SHA1 a0ea4a6a9ee82f33ba7a132d76160e7f16532059
SHA512 7339031246c409b0cbe2a1bf821a0b78f84f8555edd33a94705093ada76b039608c7fce876ce364450c23a49056084b92eca5a02b72641d7a3ce4223633f1129
TLSH
T1A7E06856327751229B7158ED1DE8F39CDC3F36439A90DF284084D00208AEBAB8462FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a0408.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe5a0408.TMP
Size 195B
SHA256 87613d55504d70894705c75ffed6d1e0045f95a557a4ba05ef2e06572e540228
MD5 804a87178981afeb25c6f6d825b51995
SHA1 bd69c2f00288576981c487770cdd89f195db474f
SHA512 a871dd35463f295a2191fca7b33b8679fde230c29a2f3d771c68e1305e2a36f800f60b8ae1ae1f6c92c553b736c0cb5734e3653dab4fc94b7e5b608fd5283440
TLSH
T199D0228640336007CB7051E61E69F38DCC2F3E835DC0CD698088B0410CB53964082FA3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 3e7e4e4adb27cb19dfd427f9ee46713d5e05f5da96c8c457542dc8bf5bf589f1
MD5 308466adcf2df56dbd69aee4fc3271ab
SHA1 63451093677d946999cd0e16eb0443aed7d3f63a
SHA512 aec108630ec4ac705a7714483fe389d3bdd5ef29f31e1eda798113713162abd197f7c9dad7f405bc876429edc5797d9e7ee3635cedd99653e82c8c1565820bc6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6d79cda4fe620e16488ed253b24b99d642e34aa5db1d7081f290c00ed0ce9593
MD5 c8d1dbdb0085eb3f6a2459e68ad8b696
SHA1 fc13e3f14f5264847f37d52178fc13464169a64d
SHA512 b57e0dd48dddc6ac860c33dc756b3f14d9869291bac66ca678a119f8780aa3c0fe139ed815bded52435c89bb0d4cefffe21699b0a5003f65ba784c759242f4f7
TLSH
T139A00221A95D9017C4E18F70204E51903B7148121707D2015890E0BD8FD775595C9196
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1b251c4441c39c44ac4990ac673e5e43b21f95853bab2df4256bfda585d6341e
MD5 6612868d402a8b5f05832b0be4adee55
SHA1 07dd60f031bd7625a69ccf30b2749549df84221a
SHA512 02d2d0ca870f6db9c55e971506e9a13a8c46ca0248835c889157e4267a3e8a7caac73a2f054e220d12224a38d884aa93d2e954cd1632c69913ea2668fd45afe6
SSDEEP 96:KRFSr/VPTXW2r7gooK4tgaocII7aglHPMPNP4PcPWPaPOP8WPqPnPngP2OP22K49:CFSr/VPTm2rEostgaHII7aglHU1gkeC4
TLSH
T176917600353A42813C7EBA1881B88D5F56C17CB27015AA6F7BED41A35F27E169DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8f51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8f51.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 dd20e97f0ab9ce8f9ecaaa4a8327623fe836f427cf8d81c55a9a1e1019312161
MD5 33568277c26005291cdce5fcc50eb2e1
SHA1 8c3f83d035296747b7929e6646fb5d86602671d7
SHA512 13e4f34375316a8b5934f14a2e661d98932494acf038e6a2dac19bc1b489c38ae0779b41844147e2eb7ac749d46be478bef4ae635c0425d9354293ac3ec143df
SSDEEP 768:gF6D3HwgtxxsOWt3l7ONXyer1IRCzni9WD184pKYi:zD3NE7SIqnxWWi
TLSH
T1EB038E35D895DE6B9CE693C2B6067743AEF46067C9C88AD0EAD95F4D00C329E070FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1389de5e3b7a81f3c71588287c34d545a980b9f09b07ad56976f0ba29a0e1186
MD5 4762c0adfa6f7d1a606c43dba1d5b26b
SHA1 395c21d013b2e6de18b2272e35f3d91c6e3804a7
SHA512 02559acac8a8539b71909d14d2de40174e0c1c562107c4aaa97d58ea821f4e85ad05cc705822efefcbb9256fbb9f36af3e121e8135522b07d68b41a3ab1aaa52
SSDEEP 768:arv+4UNbdz3Zm/TBOWt3lqONXyer1IRCzni9Wf:absbV3kNqSIqnxf
TLSH
T1DE03AE30E569AE234CE6A296B10B77937FB8306789C00B50EED95F8D058759E170F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 005d5acb4e80ff81a2830278551529286588e61cd7231caa4c443da9e28d7b90
MD5 74891d490ddf07e6a1b912b7cbf78e28
SHA1 6b4eeadd962fba731eeb246e9898c05f83661169
SHA512 a17457961fcc7b9f55d64604cb4e544a95028d15e9698d80cd97858fec38e9c20368224673d8b907e5055f4a8ddd1cc2d73944ff34fd4565058fc6b9d99c5eb9
SSDEEP 768:+g3VS/TBOWt3l0ONXyer1IRCzni9WD184pKYi:+g3cN0SIqnxWWi
TLSH
T1B6F2AE30E999AE634CE5E3C2B50A7383AFB86067D9C44B50E9E95F0E059365F170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4a5f6ddaef417709d065a1095cd73a63b66614d9ca6fc229336baa43e2bed834
MD5 e0285cd1c5fd3b1f0a7cad6438390ec6
SHA1 8744e6827d84553a45a9ff818c91ce06e51a3b74
SHA512 9d75fa4211a64b75d69c0e1e501e4d96b2285f30ccfc35b5b5e509aa5f0eccb5320826b6fe75ba372d79d95279c83784386d4de50e8018adb86319a3e708284a
SSDEEP 768:oZ3im/TBOWt3lqONXyer1IRCzni9WD184pKYi:oZ33NqSIqnxWWi
TLSH
T1EFF2AF30E995AE634CE5E3C2B50A73836FB86067D9C44B50E9D95F0E058365F170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8eaad3abcb543d5e6f0a0f7ef8fefc8f67eb4c5564c81f7ae64dcf4baf3ea68a
MD5 078d077c8b45ae6b65481fb126ebe504
SHA1 48fb250fce8f995b83c11f92f589da3e4b0a38e0
SHA512 793d7bff62b9df11b2395f8968e735faa2939ca5d561c9c972eb48d4e4b8919c9c7d9f387fdde2d24a7994176990be63d40b9911586e30edae358312f4d9fbfe
SSDEEP 768:ZI3ezy/TBOWt3lqONXyer1IRCzni9WD184pKYi:ZI3zNqSIqnxWWi
TLSH
T1F8F2AE30E999AE634CE5E3C2B50A7383AFB86067D9C44B50E9E95F0E059365F170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ef9ccf71605c81ef44d1e29b5edd93460680a2d55991a27bc43560dfc865d3f7
MD5 7cceb2178cc4802f4478f584a91bd7c5
SHA1 05eca52424c047e5520d9c9c4e2b45e9ee6ecf95
SHA512 688e7209af4e0714734bd1337ab296f4c691dfc9ed778d09b757165d98e648be536f1f7b94c003eb91c37f91b4bdf4aa44dd1a67c4393a0307a803b74912616f
SSDEEP 768:TI3VS/TBOWt3l0ONXyer1IRCzni9WD184pKYi:TI3cN0SIqnxWWi
TLSH
T12DF2AE30E999AE634CE5E3C2B50A7383AFB86067D9C44B50E9E95F0E059365E170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b93d07ebbeae1fc9f1ad3361f6e467a040da00a9a8c43b03a7b0180bc76909d0
MD5 e319fce4e99196a50cbe7ee0044fa126
SHA1 e77d90fb9e912629410fd556a0629034c48e57b2
SHA512 e516e22bf1b483425ae3f4b6bef161d75d6dd10d7cb50d7975e8284d058b62335e91059ca15169800876f636de3e3001421de489e8b79eaf2be393dbf0318ede
SSDEEP 768:Rrv+4UNbdz3iw/TBOWt3lzONXyer1IRCzniwWeVH1SK7:RbsbV3FNzSIqniEH1l
TLSH
T18B03BF31E5A9EE335DE2A396B14B73437FB8206789800B90EDDA1F4E069759E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a9599c9e1ea13329ec0a7c4689859cb5aa666dc462e4322569afb4857dd310a8
MD5 90ac4309599c67e8bf0e2789c3287954
SHA1 7923d32c35e1cc446cbe4bb9414bb3576355a147
SHA512 e7280fc23fa175ce331da6bd3f0df91db99331aa61d76b869a329f008597d6215072357f2135792ac0ce87c06968905e438431a7abab17f06f3ca63ab0e9ebd3
SSDEEP 768:hrv+4UNbdz3Ab/TBOWtqONXyer1IRCzniBWeVH1SK7:hbsbV3QiSIqnpEH1l
TLSH
T1D803BF32E4A89E338CE2A3D6B14776037FB86057D6840B90DDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

5bbd0ca8-7bde-4012-82c0-0d74a85ac0f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5bbd0ca8-7bde-4012-82c0-0d74a85ac0f3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Tmp7D25.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp7D25.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1308_1650170184\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Set up School PCs Installer.exe

Path C:\Users\Admin\Downloads\Set up School PCs Installer.exe
Size 796KB
SHA256 7256818722bfa71845f64f2405891d7d7b493d9d2125d2a5392c8f141477129e
MD5 293fee36f28a84c0e38146b5b8bfcaed
SHA1 c4a42d2eb944d4de540717bde1fb09c348a9fc79
SHA512 0e02dba06b87eb1714710dd27937cdc9ac14bc8afc4971646f3e4cb1fd3e12e0b625b037560a8fc6ea694cc771d9197ce81a57204a918c168e555081b08b69c1
SSDEEP 12288:hDVL+7JSjDPQ9khNcp3IjE/Y5C9+Xy34lYhOsfzGP3E:+7WIAcpYjgY492y3wMO06P3E
TLSH
T13D059E906BF84019E7BF5F76B4B248168B75F903A8B9E7AE4794509E2CE13038D24377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

results.xsl

Path C:\Windows\Temp\SDIAG_225a3195-2f1e-4d61-945f-39635d98d833\result\results.xsl
Size 49KB
SHA256 e67e7b17dda9b951a6a3645a67b47f2d3935cab6b7ebd773b90a2b581ec237e0
MD5 3f87c7d1657d26cb4d5dd694f43d8721
SHA1 142f38479c7d4203aa864855c7e4ea7ed6debe27
SHA512 ef2e0862d5bea3d4136b91a717f59522c8c2de8f1745c7c11968a574429600577424a5f49d87dc799fd9cbb4381dddf6dc863fe30b964d97ce4f633132df55b8
SSDEEP 1536:hUSHoDY109NVZOW9abDoVJrV9+bBH0t9mYNJ7u2+3:SAoDY109NVZOW9abDoVJrV9MBH0tgYN6
TLSH
T18F33DDA4F09CDF3A4BB5716BD8F2A582F61BCC366A356091F0FDB233129DD241522627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4296-1243-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1228-0x000002047BF00000-0x000002047BF01000-memory.dmp

Download

memory/4296-1246-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1247-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1244-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1245-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1240-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1249-0x000002047BF30000-0x000002047BF31000-memory.dmp

Download

memory/4296-1241-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1242-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1250-0x000002047C040000-0x000002047C041000-memory.dmp

Download

memory/4296-1227-0x000002047BED0000-0x000002047BED1000-memory.dmp

Download

memory/4296-1239-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1238-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1237-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1230-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1236-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1235-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1234-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1232-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1233-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1231-0x000002047BF20000-0x000002047BF21000-memory.dmp

Download

memory/4296-1248-0x000002047BF30000-0x000002047BF31000-memory.dmp

Download

memory/4296-1226-0x000002047BEC0000-0x000002047BEC1000-memory.dmp

Download

memory/4296-1251-0x000002047DAF0000-0x000002047DAF1000-memory.dmp

Download

memory/4296-1252-0x000002047DAF0000-0x000002047DAF1000-memory.dmp

Download

memory/4296-1203-0x000002047BB50000-0x000002047BB60000-memory.dmp

Download

memory/4296-1187-0x000002047BA50000-0x000002047BA60000-memory.dmp

Download

memory/4296-1224-0x000002047BEC0000-0x000002047BEC1000-memory.dmp

Download

memory/4296-1222-0x000002047BD80000-0x000002047BD81000-memory.dmp

Download

memory/4296-1229-0x000002047BF10000-0x000002047BF11000-memory.dmp

Download

memory/4868-1067-0x0000023D5DD50000-0x0000023D5DD72000-memory.dmp

Download

memory/6076-25-0x00000196C29F0000-0x00000196C2A16000-memory.dmp

Download

memory/6076-1-0x00000196A7CC0000-0x00000196A7D86000-memory.dmp

Download

memory/6076-2-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-3-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-4-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-5-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-6-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-7-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-8-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-9-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-10-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-11-0x00000196C2AF0000-0x00000196C2BAA000-memory.dmp

Download

memory/6076-12-0x00000196A9AF0000-0x00000196A9AFA000-memory.dmp

Download

memory/6076-24-0x00000196C2A30000-0x00000196C2A6C000-memory.dmp

Download

memory/6076-23-0x00000196A9CB0000-0x00000196A9CC2000-memory.dmp

Download

memory/6076-26-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-27-0x00000196C4EC0000-0x00000196C53E8000-memory.dmp

Download

memory/6076-29-0x00000196C4600000-0x00000196C4608000-memory.dmp

Download

memory/6076-28-0x00000196C45E0000-0x00000196C45E8000-memory.dmp

Download

memory/6076-31-0x00000196C4630000-0x00000196C463E000-memory.dmp

Download

memory/6076-32-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-30-0x00000196C4DF0000-0x00000196C4E2E000-memory.dmp

Download

memory/6076-33-0x00000196C8F00000-0x00000196C9088000-memory.dmp

Download

memory/6076-0-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp

Download

memory/6076-74-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/6076-92-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download