hxxps://oficalsantandermx[.]hstn[.]me/?i=2

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://oficalsantandermx.hstn.me/?i=2
Sample260811-2yg4kshb95

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2972	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309628021883838"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{57E375AD-B415-4B2F-8D59-421C929CB95F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 3296	3428	msedge.exe	83
PID 3428 wrote to memory of 2972	3428	msedge.exe	84
PID 3428 wrote to memory of 1692	3428	msedge.exe	85
PID 3428 wrote to memory of 1692	3428	msedge.exe	85
PID 3428 wrote to memory of 1692	3428	msedge.exe	85
PID 3428 wrote to memory of 3388	3428	msedge.exe	86
PID 3428 wrote to memory of 3388	3428	msedge.exe	86
PID 3428 wrote to memory of 2380	3428	msedge.exe	88
PID 3428 wrote to memory of 2380	3428	msedge.exe	88
PID 3428 wrote to memory of 2380	3428	msedge.exe	88
PID 3428 wrote to memory of 3760	3428	msedge.exe	89
PID 3428 wrote to memory of 3760	3428	msedge.exe	89
PID 3428 wrote to memory of 3760	3428	msedge.exe	89
PID 3428 wrote to memory of 3500	3428	msedge.exe	90
PID 3428 wrote to memory of 3500	3428	msedge.exe	90
PID 3428 wrote to memory of 3500	3428	msedge.exe	90
PID 3428 wrote to memory of 2468	3428	msedge.exe	91
PID 3428 wrote to memory of 2468	3428	msedge.exe	91
PID 3428 wrote to memory of 2468	3428	msedge.exe	91
PID 3428 wrote to memory of 2196	3428	msedge.exe	95
PID 3428 wrote to memory of 1852	3428	msedge.exe	96
PID 3428 wrote to memory of 2196	3428	msedge.exe	95
PID 3428 wrote to memory of 1852	3428	msedge.exe	96
PID 3428 wrote to memory of 4936	3428	msedge.exe	98
PID 3428 wrote to memory of 652	3428	msedge.exe	106
PID 3428 wrote to memory of 652	3428	msedge.exe	106
PID 3428 wrote to memory of 652	3428	msedge.exe	106
PID 3428 wrote to memory of 1220	3428	msedge.exe	107
PID 3428 wrote to memory of 1220	3428	msedge.exe	107
PID 3428 wrote to memory of 1220	3428	msedge.exe	107
PID 3428 wrote to memory of 1760	3428	msedge.exe	110
PID 3428 wrote to memory of 2340	3428	msedge.exe	111
PID 3428 wrote to memory of 976	3428	msedge.exe	112
PID 3428 wrote to memory of 1876	3428	msedge.exe	113
PID 3428 wrote to memory of 1876	3428	msedge.exe	113
PID 3428 wrote to memory of 1876	3428	msedge.exe	113
PID 3428 wrote to memory of 3276	3428	msedge.exe	115
PID 3428 wrote to memory of 3276	3428	msedge.exe	115
PID 3428 wrote to memory of 3276	3428	msedge.exe	115
PID 3428 wrote to memory of 4472	3428	msedge.exe	116
PID 3428 wrote to memory of 4472	3428	msedge.exe	116
PID 3428 wrote to memory of 3888	3428	msedge.exe	117
PID 3428 wrote to memory of 3888	3428	msedge.exe	117
PID 3428 wrote to memory of 3888	3428	msedge.exe	117
PID 3428 wrote to memory of 4392	3428	msedge.exe	119
PID 3428 wrote to memory of 4392	3428	msedge.exe	119
PID 3428 wrote to memory of 4392	3428	msedge.exe	119
PID 3428 wrote to memory of 2152	3428	msedge.exe	120
PID 3428 wrote to memory of 2152	3428	msedge.exe	120
PID 3428 wrote to memory of 2152	3428	msedge.exe	120
PID 3428 wrote to memory of 3368	3428	msedge.exe	121
PID 3428 wrote to memory of 3368	3428	msedge.exe	121
PID 3428 wrote to memory of 3368	3428	msedge.exe	121
PID 3428 wrote to memory of 5816	3428	msedge.exe	122
PID 3428 wrote to memory of 5816	3428	msedge.exe	122
PID 3428 wrote to memory of 5816	3428	msedge.exe	122
PID 3428 wrote to memory of 3996	3428	msedge.exe	123
PID 3428 wrote to memory of 3996	3428	msedge.exe	123
PID 3428 wrote to memory of 3996	3428	msedge.exe	123
PID 3428 wrote to memory of 5316	3428	msedge.exe	124
PID 3428 wrote to memory of 5316	3428	msedge.exe	124
PID 3428 wrote to memory of 5572	3428	msedge.exe	126
PID 3428 wrote to memory of 5572	3428	msedge.exe	126
PID 3428 wrote to memory of 5572	3428	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://oficalsantandermx.hstn.me/?i=2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8275c188,0x7ffe8275c194,0x7ffe8275c1a0
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12902873558757374633,15593145496095433158,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16440683793871985817,2790172331513498034,262144 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,7704730783698490505,5072668831248758852,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11301457645623267525,6229309656787547135,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8596243901158616833,6104219984728847784,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,13485158058894676177,4520940639862764186,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,8503580888252141125,16438938969268747951,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15807177164783252003,13645856219020883397,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,14111479653010017905,13919135363442333769,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2299380791240949693,3615078599693116788,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2299380791240949693,3615078599693116788,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6396,i,6419007414072432470,9273287840251618671,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5920,i,15206839273876846132,10868226147087757731,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,9555893412736491465,8152480482240322177,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=128 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,8712056553487281984,13637752353038991185,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,16836713985008342253,6491519338987736549,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6440,i,2212190789303529835,1307666732844067013,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6124,i,8038676401804161737,18125013278373919510,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10615127760729884830,5605065751459859217,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5480,i,3852553675680288106,9914911137335608666,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6352,i,11533075421136591039,17982860506850155832,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6804,i,5753258598592671372,6143284737296949207,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6880,i,11969733114318126261,12552679742639616330,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6772,i,13930369222716793179,3545984980664751581,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6444,i,11041477049508364191,7466163140900931800,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,5204224801032273500,4824400768224352694,524288 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6944,i,10189029783217236356,10684351568187018718,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3688,i,4365298953518752301,4513910130177429315,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6796,i,16062771151793456920,5022838415874793269,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6672,i,4381091784434869580,7444027542651190010,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,3775031335635586187,17174518765571736098,262144 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6248,i,14399052282660903237,2940451372657260977,2097152 --field-trial-handle=2224,i,2217699539436770763,14547155127366083124,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

09083645-6015-416f-af49-342561d2a2ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09083645-6015-416f-af49-342561d2a2ba.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4f685b52f00a6e92012f40fcfe91a15f97ffea8290309f242319d9b69baeec74
MD5 5288be1651a63908cbc56c0b472b429f
SHA1 092b5ebf602f82ae000153592ec9cbdbc9dc63f9
SHA512 cd7aa4b93e1c753d85ac11bb5b4b767b601af40c0953a68061e6c4ea89fc7197b3dd545981dd5c97a83968a449aef06d7908604d1ffb7d4c3bff52a8958b6148
TLSH
T181616EB0050FA779F30A50F157D21195343288DEFD432F34136AA9FA1DA430391D9F96
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 cae5427e6477bdded2e1468665791b4f9c5e24b4f1136045c3acb8aac4576f4c
MD5 c3884a5482ac0629d8433df0de9a2052
SHA1 9b44444b66b5841375ed16e5c3d20f2aeb6e0349
SHA512 ef8b3d6613486bef08efd156925980cc2c0c7b537cdc436513639ed3030955efe994286dd7d0d589f3c15a8068d15a42ccbd602eb15d56ecf6c19d5187a84775
SSDEEP 48:67lp8pt70Hm+TBthP25rYZyqFb3SfM52LfBJSWtjOPqe56BgIq7XdoUGxnCPoHZv:67VBbPcUpb3sMYBWqIQDq71zPo5TsY
TLSH
T1AEC10CB0448FE364F78AA4B263920B502572C1CFFD03AF31162A6CE619663D341D5F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 80912a18d06316789ce434866e49cc4df3ea3aabee552c1d644de10ab67a0787
MD5 d8131f682b6b49d7526bcdbedaeede96
SHA1 63c07b72484e5c882250e37b6875dae524201182
SHA512 f912e2f07f407d563193059a0ecffa3afb8a614eec3bd486869cc23e9adf45fd8a5d7e14ca2d73f8b7eda04d1a8c550cc5b28d2a6731a9b424becc3773495458
TLSH
T163519AF2C3E6816DCA1195F09E14AF1BCF2C0556436C3D4989D8AF4BA3B2871E012B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 59308df162d016d2adb45bb69abc71b89ab1c1282a974b0585cfc29856021b16
MD5 ceeedaaa7c2f717e2a7f88d0daf0746a
SHA1 847fced5391af12d1235a9dc1c40df3aaab9e7aa
SHA512 c6930a5451d8f73aabeb0a996dd80a2a5bdc4eb3eee011817f7c51857d9ac7b55cd2fc8d76aec7aadc8268a535198df9e500d9b60e537378c3736b41f5e34577
SSDEEP 192:sxZORPvk7/frsCoxIdpJHW6+WNGYIwyZ+NIgrJ:sxZOJc7/frsCo6JHbGTq9
TLSH
T13F22B8116E28A93B8CC7D31DBA15BF53E6F95032A1D41E58E6FC961C05E6ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 70c205d3508fd428d249f9d452647cbe8c59e580e5444e1be8abca3233afbbca
MD5 81f1b17e6cb0abf5e091ba2af9e99249
SHA1 34362524564798cfe1b40c2b6b42e03d06d75a87
SHA512 4bb5455cc18c0a8efdbc693a8f4737e3bc11f7a00520ddc3db76bb1aeffd7a7d87d2960917637b4513e91434ad6144e7457aba3d94dcdc57c048cb6e289079e6
SSDEEP 192:sxZORPvk7/frsIoUIdpuzHW6+WNGYIkyZ+NIg5EJ:sxZOJc7/frsIoNwHbGfqS
TLSH
T13D22C8116E28A93B8CC7D31DBA19BF53E6F95032A1D41E58E6FC961C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 df112da64109a56a6787b03692c5ab685678548338834eaa2e439ccdf96aab27
MD5 1c4f5fc75e35fcd85fabc62a5d35978c
SHA1 78870a91a5587c8db5e0bd92977a2af5285d051c
SHA512 9431e5c44301c40cc099222bdf173622ecf36be09df41f5230398d680a5e81dddaa45d58712df532e4fb8e04c97ca756de632adc80e9c9af57d66a332c6f3786
SSDEEP 192:sxZORPvWO7/frsIaUUdpmj8zHW6+WNBcJ4/YI/2Z+NIg5mJ:sxZOJeO7/frsIapVHbK4/oqQ
TLSH
T1F632DA126E2C697B9CC7D30DBA15BF53E6F95032A1D51E58A6FCDA1C04E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a21a06749b742907d8e0feca419f4ba1fb6eb0476f53cb99ef42ce4c1e1e4dd5
MD5 a97b91f6acf9868c9fc739a4f978389e
SHA1 e217c566c736b05343b2fda0e35851a3e89c45a9
SHA512 5024650f852d9506aeeefb2bc6eb3b48c942572225c933d1b9fc9ea8ce14b927743444321b2b5737e07a57ad17041235696518d501577223402aeb7fe6d8795c
SSDEEP 192:sxZVQUnqRPvk7/frsIa4b5Vddpmj8zHW6+WNBcJ4/YI/2Z+NIg5mJ:sxZ9nqJc7/frsIa8XVHbK4/oqQ
TLSH
T13A52E8126A28593B9CC7D31DFA16BF53E6F95032A4D45E58E6FCD91C04E6ACE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 860530cfd7a843059e7713aff2dc50293a0a56a1b60dc5b093e7b205b473d441
MD5 249bdccee96cb38a503c619756151906
SHA1 007c4e89db7859715f050ce12abe42dc8afc81aa
SHA512 4df3f99ab2fcd33f7d7a0979f52492f7ccff4a4b10866e0c0510e449aa9500ce167bd6aade98dbd1b3460f5cd3577b94e8be97c8315143b26cd5b47e7c1361f8
SSDEEP 768:n6yqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7ErogFN:n6yqbblWvJDjTu1jah4LAs7Pgj
TLSH
T111C2093B654CCB7E4FC00AADDC5A6FD73E9802C7A6588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\198aaf51-a116-4a54-9eec-30697203975a\index-dir\the-real-index
Size 72B
SHA256 c8436e01f96d4cb263619e643342e20be46f4607743968bbb1e03b4beac1aafb
MD5 03c9c7a47589e40c0e4c2e1c9d48046f
SHA1 1b7aeaac2cba1b5f172f4f800d41341e9e17a48e
SHA512 afccb701de2ba7536b3cdf125424570a8f59eed0c423fc74e0dde7fb2baee2415bc10d50189727f07cc024adb253f4e6846f23507aebb743ed644ce64a085590
TLSH
T167A002914AD41532D207C3785043665CA790592007E1CF0743B6BEB4E8A82454256411
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592244.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\198aaf51-a116-4a54-9eec-30697203975a\index-dir\the-real-index~RFe592244.TMP
Size 48B
SHA256 27614c1b545101619d2162f1e1e47b1628e31d620983edffe1ad8c761ea98a6b
MD5 10953279603ce0898307b3a9b0290288
SHA1 a337ff18830a1489eacafe0aaa312ee5cec9586a
SHA512 a16331472ff33d8378c721017ccbda87a577161bc78e3605a5832099af09ab31f061cca274c8f88e88e9ac73c411b8c2eb444943da6d177a25d5752e1c9b268d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 f471e097ad360df84d60749ad1a21a9198d765f54afbad6a46f5399bd735c0c1
MD5 4e03cfb7994a6450a39d1a569b1401c4
SHA1 1fa1c84b05ce9bef4138307401a310f3c0734fd4
SHA512 f8b97f64cbc23225b42e122cbf4fbed77f9dd63f1db4bf1032cf63c7e086b9575d897779ad0534ff43491f8d29fb1463e967cc4a6922619197ee8dd4af8777ca
TLSH
T1BEA0023403D0D211D00616F165D7C34136A54A110205274D71F14158C8606D6855548C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 c41a702b4552324b82a1f21b2043e4bbd63d6e0b9f7153c539738183a67a3a2e
MD5 55a5b55d3916dbbd637ba3acd9e7f522
SHA1 a000096719b52c6f5722a1196233652889359ac9
SHA512 11d24fef29f461a70d5e673d20fee95f88c535ab1b5ecdc11ff81b52216b2ee8c34e1fd7aa990bcbbabf82548e4287fc39be8d639a3ab79df04577478a063d2b
TLSH
T12DA00212038442CADC6622B1195206511300DF106500A31741A21145CD534C18D9110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bbfc1693-6097-454f-b94b-dd68c4f3ce0a\index-dir\the-real-index
Size 72B
SHA256 bd782ecde5e7e59203e4b9e593d14be46aaf42f5933487630c7387211b6138bb
MD5 a7a041bfaf1c625ee63a27f3dd8fbb1b
SHA1 701a13e5bc4e214da646e8831250bc02b06537d2
SHA512 169f0076ae2ec2d5d230fafb426382b40dcf1ade30091477b06be41e4836ba4273b479d3cbc4e99abb4e78fc38e6c0959f8100e9eefca3d5f591d251acc1ff21
TLSH
T114A0022556D60487C00506F591D217742B285C1AA52143078190165A8C9537D451F04E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 ea42c794f7d50873fe5419fb188a7620108de34c4ddd918990d3f21753ded3a8
MD5 7d76edaa1b722c851460e2191f6fbedf
SHA1 41ed1ec4e22ec64d5a28bcedd57fcb1de631c857
SHA512 9dcb7c2ef2bfdacd0393f5d193a348ce8e5771a10ae2277af5afa3363a9df13b768893a9f21628d2d4d2430213ddd111e304ba633939a5e4d45cd1279d186fd5
TLSH
T11D511A8E4C4B2C6DC4AD11B27CFA094173B568EE47899A0F379CA1307CC333E2D51165
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 720B
SHA256 386d7b1fed7b3174394f87a01f3a185da486b17a06102db472d4fbb7430e52dc
MD5 f211e592626804980f97cfe574519adc
SHA1 527144968c1c440dc90618da8aaa4b71ab49bc75
SHA512 56c09f826274633588c07daa7f1c00ee819426de8e26fc3c1be1491e514f97d43feb12a24b3c29612905bd0700c5d70b18b38c807e968bc919f0b21c0560ea24
TLSH
T16401C0891EA15D2FF9924AB314B520F0B371C9DC7B22D52B543D66273C2634964561C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589bbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe589bbe.TMP
Size 720B
SHA256 627284c2fa3fe98c4fb4783059b05bc379bf66bdad89b8072c1ed6df61153b09
MD5 7d2edd3df7227a1195b7f35533c5e277
SHA1 9d843bfe58e18bd2517bea42da77fa3114a6fdd6
SHA512 29d838cf541945c492b6e9d14906d8338a58b1512331b153d630a010b0caf74c97f2ae6c93235c6a492413841c5ad3ea4bc5f07f9f09106fea830a573ef48661
TLSH
T149010E868AA14E1FF8904AB6189610F4B231C9006263E6B3607E6A3E6C3A78D69570CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 cddf17632d31dc66b1b9f78fa15b629bf66b67a46ed4e423db16b67ac4b93500
MD5 a8ea19c4ad391dcac4e3f4629f3633af
SHA1 61f33d33683b6e7bafdc45504906105509fbd335
SHA512 9717b906c277f77f8704fa1f1fdb867882ba0a78189b27ea13fed9297b80fd11a4d4aadce0135761b25a839077d081f9dbd189e1bc402fc08f9975e2009b599d
TLSH
T1ABF027762BF71C08F8EBD3EB157314A60914BC688852FD4F1116B59B9472275282DC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 d17f67785fe918e276f4a727f8e9bed6fdc28fe21a51edeaebbb91386551781a
MD5 67dabaa6785feb64098246ee5a735399
SHA1 22d2f7e7b6598bb70527b8eb55daf3206d5981ec
SHA512 49a2cfbc4f97dd8230798f39507ec6f15ca0a4102fd014fc84a15b765be08e956809aeb1cb9e22ce21240718f607cf78052946855470e68290dff863f25fac77
TLSH
T143F0DC762FF30C04F8EBC3EB197310B20500B828CC61FC8F0015A58B4472370282CC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9afe52489f9528a3561457acd73c6bfd86f9b09767ecb4e4223385876654d929
MD5 6552531d203c1648771d816547b13168
SHA1 8467b05b34358e430a2286d38f7aa608a048d570
SHA512 5e41cfe0353776ab6d3e4ec2e32d0a84355189c2f3cb52f539e924961a78573b695ebb2752a244e00fd89b3b94ce6edb0014e95894ae28bd5d51a1bfebdd45f7
TLSH
T154A00226AA4E9005C4854EF033656768736C6CA9010553094998A0B98CF6EA751C699A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f150.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f150.TMP
Size 48B
SHA256 590f1c8b199f2491773727ae69deb8bd97b3551081df77b3dd271c973b7d27ee
MD5 82ca8a1a8492fe9997c7046c58309c32
SHA1 fcc5c1c9aff455fd8707f7abc9a68a128af2547f
SHA512 60829b6e662cd539ec3e076131145e8daa4ca43062f6305195d4f5b9dd3cdb558c52a2396055584f9aa43cf28e6bf22f9796c703b3915f1af05c8d29883091a3
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 09e1473e01840d12773aa53f803704692468362f4d7604fdcfec26897cd57262
MD5 d7042f23780f7cdf1391147f7aee85f2
SHA1 2e2bbd941593e65ea7c3e45ae0539392393a51d6
SHA512 bb5107d90f570b6a2a21487de79b0228e084f861ba5b2cec14a763ce20c59a90d26d5729a6b13dde90870f53113068caa7ce7d2b97579fe4923cbe29ad9a4c21
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyskHQE6SC2cS99IrE2KKTCm22smNFWkc:KYbaKYIKmdCK+wSOneK8UTz
TLSH
T13491E30A72360283393E2998B2A686774F4532633459A5AF3F7944714AABE134DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b859d0e5-5a4c-4bc4-90cd-78349ccaa121.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b859d0e5-5a4c-4bc4-90cd-78349ccaa121.tmp
Size 13KB
SHA256 6a3a85ebc57b6187592073e2bd35df3bb66d99a40234f32e51feffd5ac70db48
MD5 204735dd45e217edb06f1000c35de504
SHA1 df45515c319c36ab61af6a21de6a4de0846f511e
SHA512 f9c4c1024cd73f761d056a23aa1acf1d19ff03c3d0471521a49749ba96b1ff4492e8fe540c56a87bf573c3425d4fe1aa8af9f3010fb1ceeced1c74cab01bca47
SSDEEP 192:sxZVQUndRPvk7/frsIahXb5Nddp4flHW6+WNBcJ4/YIQp0+NIg5mJ:sxZ9ndJc7/frsIahVfUHbK4/5qQ
TLSH
T18552F9126928583B9CD7D31DFE16BF53E6F95022E4945E58E6FCD91C08E6ACE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82150605-dc78-4514-b814-269941dd9bdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\82150605-dc78-4514-b814-269941dd9bdc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ef85839abeaacaf1977ef461b5ff06ec25a5da007c7353c51aa748654535fda2
MD5 03589108b0295a0d1b9ccd69665ecee5
SHA1 d3b8f2bdb4a0ce4652f68084a62b9ae57c0dbcf1
SHA512 cd3382209f7ca3d78537e9fd53b54cd81b775891f11e119240a93d7344df92f8fc0595e18648906bde25f9b4303cef51c4bd37bb3937fdcf5bdc29caa22976be
SSDEEP 384:+ZcIhsN6Uda4bIs1VRNuOPxQ9eYHkcopQxJqoXCM:8hvgbHuOS9eYHPopQxEoSM
TLSH
T1CD929E71AC782C766AEAA545F98B36134FB8A137E6C85F80D1DCAF0D05DA5D8030BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 997d76604b28f65f448eed4a67c806a09109434cd639da91bc9dc1eacafa3e0d
MD5 accfc1407634254de0bfcf7954b7fbf1
SHA1 bff4eee4fa262f127a9b092ba4eb59fc38cd681c
SHA512 1fa6fcc1839cd7099f92f8107861eb4f82a5abec6052d4c33ba34d8be3a4e7c28d038c77a6da61f4b9550fab03c1702123e95c5f8e9e3d4949faf8b07cbaa2f1
SSDEEP 384:ciFiZcInsNf8TUNTUlIlgTM4bYHe2VRNuOPxQ9eDHkcopQxJqoXCM:HFQnewgxFeUHuOS9eDHPopQxEoSM
TLSH
T1CFB28D729C685D7BAEEA9A44F94B32138EF45077E5C5AE90E2DCAE0C01DB5D8030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 073d1f4c8426494ac69bb872cc62b5886374451a193a77d2281bff12555837ac
MD5 721749490ef8eb02431c61cb2293aa81
SHA1 a012d6f371d5f0048343d745bc1f9175ebff25cb
SHA512 91fe65259310f3a2a8f4a728f6390ee6f2c1f2efb01ad01eed953c88d7bfdb91010f7cc142cf1e1399fb789f0b8b5c3c266fd6eed2193a35a1ba402e2706f0a9
SSDEEP 384:5ZcIhsN6UETM4bIye2VRNuOPxQ9eYHkcopQxJqoXCM:RhQWeUHuOS9eYHPopQxEoSM
TLSH
T16D929E71AC782C766AEAA544F98736134FF8A137E6C85F80D1ECAF1D05DA5D8030BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5231440b31ea999c6bc6403f9d20085ee2ea5ebcc43377c9ce858a4fe27cf209
MD5 55d80a23d6c1fe6e8b55fa9e2989e23b
SHA1 94248215895e9acdb80ad061d98f6be2fe2c9c4d
SHA512 4a5f81d30e663f75463cd824e61e9bbb0aaf49097a4c539b44ee433d142a00c7cb3cffa2d867add662bdbb8c251e29d3d974b6eaa3bbaecf730285b4066d5105
SSDEEP 384:qZcIhsN6Uda4bIs1VRNuOPxQ9eYHkcopQxJqoXCM:IhvgbHuOS9eYHPopQxEoSM
TLSH
T1B4929E71AC782C766AEAA544F98736134EB8A137E6C85F80D1ECAF0D05DA5D8030BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed0f8171bb165e4db5d102614212ddfefc61df836b1772dcd0800302fab5cd28
MD5 53fb7f7079053ee44ed5e6ebd5261e29
SHA1 03d08bf70150eef9046a72a64f13b807af78c755
SHA512 ca534ccc22aeb34caec1bb7aee8c3740fd4ed75c3fb429913a6d20d34034ffa79dbe1c2e224a93a9604db835d98a928099bdcff6382ce97800cdf86cab4a5fb5
SSDEEP 192:tONW6JkRtQmiUyiOW+RNuOmYxBh3NRTU6:tONW6UrwW+RNuOPxbHU6
TLSH
T19902E835BD382CBB9EE26E49B58B27135FA4207BF9956F80DAD81F0C01D765C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77b51ca27281afebb50e54d88018249071d169f14c932d41aaa63154080860dd
MD5 807596132777b3fb09cbfaff9f4dbbc9
SHA1 912742f7a5c94f179ce28315dc59ff14c541b948
SHA512 c4604ea3441f3b2439cc625f39133f7653515579e4f505cd61105dd5ad1329feb1852bffe011becb990466e9983263160fd1aa6ef3c2e98ae67e3b299c4e8d25
SSDEEP 192:rONg6JkRwQmiUyKOH+RNuOmYx2j9e4Vc/qH4U6:rONg6UwKH+RNuOPxQ9ePHU6
TLSH
T1FC121936B9786C771DE26944F48736035EA4502BEA897F80D6DC1F0C02EFA9C130AC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d04323ac-4d7d-4f35-a579-4433f7a0362b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d04323ac-4d7d-4f35-a579-4433f7a0362b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 375a240ae9dadb4dcc879933437aff69117e0276f59e89c8f611db08d6713bfe
MD5 c55e125d4934759e226a3fa490626b54
SHA1 9247294b4c28e83a84b063239d71e321c65159d1
SHA512 6fd8e639c2dd6bf1856dfbd11d8d8578ad9a3aca80e0c65a182cbfb68011d8ccef75e15a5c8f7684d6c7ce5cc5ff336bc5486aebfbcc0845cf10ca0da5cd982c
TLSH
T1E541F858AAEA115CB3777F5A9BF6A86D447BB9772E0AE05D00110D4F0A62A40C962733
MD5 SHA1 SHA512 TLSH

Submit Download