hxxp://fractalia[.]es

Analysis

user interaction
yes
max time kernel
299s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
01/10/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://fractalia.es
Sample261001-vxm5wasblh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
60	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{8B5E7DAB-7FD7-4B22-8D66-E7009209A0B3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 5092	5020	msedge.exe	88
PID 5020 wrote to memory of 60	5020	msedge.exe	89
PID 5020 wrote to memory of 4360	5020	msedge.exe	90
PID 5020 wrote to memory of 1956	5020	msedge.exe	91
PID 5020 wrote to memory of 4360	5020	msedge.exe	90
PID 5020 wrote to memory of 4360	5020	msedge.exe	90
PID 5020 wrote to memory of 1956	5020	msedge.exe	91
PID 5020 wrote to memory of 5104	5020	msedge.exe	92
PID 5020 wrote to memory of 5104	5020	msedge.exe	92
PID 5020 wrote to memory of 3292	5020	msedge.exe	93
PID 5020 wrote to memory of 5104	5020	msedge.exe	92
PID 5020 wrote to memory of 3292	5020	msedge.exe	93
PID 5020 wrote to memory of 3292	5020	msedge.exe	93
PID 5020 wrote to memory of 2548	5020	msedge.exe	95
PID 5020 wrote to memory of 2548	5020	msedge.exe	95
PID 5020 wrote to memory of 2548	5020	msedge.exe	95
PID 5020 wrote to memory of 4724	5020	msedge.exe	96
PID 5020 wrote to memory of 4724	5020	msedge.exe	96
PID 5020 wrote to memory of 4724	5020	msedge.exe	96
PID 5020 wrote to memory of 1920	5020	msedge.exe	101
PID 5020 wrote to memory of 1300	5020	msedge.exe	102
PID 5020 wrote to memory of 1920	5020	msedge.exe	101
PID 5020 wrote to memory of 1300	5020	msedge.exe	102
PID 5020 wrote to memory of 3856	5020	msedge.exe	106
PID 5020 wrote to memory of 1152	5020	msedge.exe	113
PID 5020 wrote to memory of 4988	5020	msedge.exe	114
PID 5020 wrote to memory of 1052	5020	msedge.exe	115
PID 5020 wrote to memory of 4852	5020	msedge.exe	117
PID 5020 wrote to memory of 4852	5020	msedge.exe	117
PID 5020 wrote to memory of 4852	5020	msedge.exe	117
PID 5020 wrote to memory of 1464	5020	msedge.exe	118
PID 5020 wrote to memory of 1464	5020	msedge.exe	118
PID 5020 wrote to memory of 1464	5020	msedge.exe	118
PID 5020 wrote to memory of 1264	5020	msedge.exe	125
PID 5020 wrote to memory of 1264	5020	msedge.exe	125
PID 5020 wrote to memory of 1480	5020	msedge.exe	126
PID 5020 wrote to memory of 1480	5020	msedge.exe	126
PID 5020 wrote to memory of 1480	5020	msedge.exe	126
PID 5020 wrote to memory of 1732	5020	msedge.exe	128
PID 5020 wrote to memory of 1732	5020	msedge.exe	128
PID 5020 wrote to memory of 2864	5020	msedge.exe	129
PID 5020 wrote to memory of 2772	5020	msedge.exe	130
PID 5020 wrote to memory of 2772	5020	msedge.exe	130
PID 5020 wrote to memory of 2772	5020	msedge.exe	130
PID 5020 wrote to memory of 2808	5020	msedge.exe	131
PID 5020 wrote to memory of 4976	5020	msedge.exe	132
PID 5020 wrote to memory of 2808	5020	msedge.exe	131
PID 5020 wrote to memory of 4976	5020	msedge.exe	132
PID 5020 wrote to memory of 556	5020	msedge.exe	133
PID 5020 wrote to memory of 556	5020	msedge.exe	133
PID 5020 wrote to memory of 1936	5020	msedge.exe	134
PID 5020 wrote to memory of 1936	5020	msedge.exe	134
PID 5020 wrote to memory of 1936	5020	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fractalia.es
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffff89ec188,0x7ffff89ec194,0x7ffff89ec1a0
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,1288736666995639609,1708389793552627713,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  - System Time Discovery
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,9618296846376292574,8097974265800610992,262144 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,7912677702589834112,7903372893584269391,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3180207111012831042,9190368124425797343,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,11247011288851418534,12692353522379435761,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,13765156950695023848,1274304252277679422,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16082698963408879531,6013826563830130914,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,1947313310061672991,9776945072425479921,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16090168048083799454,2410198655329727526,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8355296322738512558,12701179495687248666,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8355296322738512558,12701179495687248666,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,16113994975481191747,3487535598997463034,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,3933487524083921110,2104783231936439315,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,4743679491704962199,5336451940253394461,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3964,i,5219920253886976234,8047764839019630630,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3492,i,9944623322483637224,12450633614555930255,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,13780943078166974700,10758039609947731878,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2816,i,12002286714253107225,13573219069599692228,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,9750437060887784552,5288295333906870378,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2052,i,3868442886327177949,13654025580179198168,262144 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5108,i,8207916112631042771,9385508671721797680,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,9735551894341503240,5433336289431483941,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,13678424322326518589,7758605075222997987,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,182196209139442311,7415392487101975958,524288 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4848,i,5698820549756991905,2534847891726005639,2097152 --field-trial-handle=2504,i,9350237246216982506,10230095453271888069,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

028f056c-8791-4816-ad02-4a0de6c88eb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\028f056c-8791-4816-ad02-4a0de6c88eb0.tmp
Size 8KB
SHA256 e60a6a01b9ffa3ec7efb5214e4c607a765d46a7f108db5b50ccd7fbc3529d245
MD5 beb1d91c152ea3636c3efde05e7854aa
SHA1 df949d93637b61f197cd247dad3d6fab9ce9e1d5
SHA512 bf9f95591f6da466d4079bd75271556bf4d5757e4800a82642959eacd1fb58cb9cb1c268051c0a64650037aa23ddb62cbee895f4a59af0d10535a6dbb534e1a2
SSDEEP 192:EON46nnHGQmiUysgQYcX5hQDP1Uhjzord19McjKU6:EON46nCQQNX5+Dto8d1tGU6
TLSH
T17602EB34FCB86C7B8AF36E49B08633176F95212BA5946B84DAE81F1C00D765C230A933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21e0cfc2-3afa-4b33-8998-4be0c1338b21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21e0cfc2-3afa-4b33-8998-4be0c1338b21.tmp
Size 8KB
SHA256 029570a33963751740132c4a03f2d87694c6db931c6459db72893681320eecd2
MD5 4a70a685e1e1762bbdc5150b8f05a45d
SHA1 0e2ff071e1666c49a5f7bbd87933f9f79458d92d
SHA512 45226c342ee84a5032f4259ad859bda5723dbac06f725a787f0c7619b73ca7541dc9265108c58c6c83c90d18a650d058f8ca0f9f6f8f51eec05f677e293c1b87
SSDEEP 192:EONnh6nnH1QmiUycgBYcX5hQDP1Uhjzord1oAX0SuRg3Gq5sU6:EONh6nz+BNX5+Dto8d17XzumtsU6
TLSH
T1DD122D35F9A8AC7B4EE2A595B0873113AEE52117E9856FC0DAEC2F1C01DE65C530ED23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

338180c6-52b5-414a-b70b-48a8e34fce6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\338180c6-52b5-414a-b70b-48a8e34fce6d.tmp
Size 18KB
SHA256 6c5478affecfd39aa9106d927d4b7eb512557c5787f252a521894e51d43388e6
MD5 da10e1166056417b465fa9e37c264bbc
SHA1 4fe7d03b25c1b272be52ce8c65844b13ddb767e3
SHA512 6499d098c0bcd1e5224062793641ac710551ba997bbbe02c9484a63f2ed1bf73d4464d18dade37e89c5c1ec7ff7c3753095f9af46b79eb4a0ef321cdac98887d
SSDEEP 384:pZcIhsNgVRHiqJTQX5+Dto8d17XzuOtstgOIwZOywEkoF:hh7HUkDXzuOtsXsqkq
TLSH
T196829E32ACB89CBB59F7A145F18B32035FF86467A5C55B80D9EC6F1D0199AA8130BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4feea50c-5193-4068-86db-a851e868aa40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4feea50c-5193-4068-86db-a851e868aa40.tmp
Size 21KB
SHA256 b6eea4b5cb5d39d466f0acdb8c48f73e759e2a6b624a21e19b5226fd7c096a1b
MD5 0473fd2ac5eb5660ab0d5a04c66c8a01
SHA1 4a4da5765617ab9354ce9a10a914ac28c28487fa
SHA512 e35e5f29b3ad4074b362e2f160bea52f20f942af15e18dcc571a091bdba0093e76ba6ebcca2c9f89c997b8dca70f1bb98812786b20ea72c7cf12659c878650ad
SSDEEP 384:+67FiZcIVzsNg8TUNTUlIlVRHiqJTQX5+Dto8d17XzuStstgOIwZOywEkoF:XFQtBwgBHUkDXzuStsXsqkq
TLSH
T1D8A26D339C98CD7F6DFB9A85F54A32039FF85067D985AB90E6DC5E1C019A5D8130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ca1cc3e-a23f-465c-bfe7-7d85c3b78e13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9ca1cc3e-a23f-465c-bfe7-7d85c3b78e13.tmp
Size 18KB
SHA256 2de1b8d6755ad1f2f8f2dc920a790130dd5dc42105c6146773d2cac303779567
MD5 edd2b52401348f27475af6e6c5898fac
SHA1 141004ac83d54c95e001b395100af8595d37f9fc
SHA512 b9a81f91e3b5ac56a94bea0667aae104c6445dedfdbcfdd85a6bedc895eb2a0c9844c90d2abf1e6526edc1eb97abf3b1959325a7ec416f58d9b31a6d3520e69c
SSDEEP 384:SZcIhsNgsRHiqJTQX5+Dto8d17XzuOtstgOIwZOywEkoF:ghSHUkDXzuOtsXsqkq
TLSH
T1D6828E32ECB89CBB59F7A145B18B32035FF85467A5C59B80D9EC6F1D0199AA8130BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

1a78a794-4c88-4507-962e-09d52b0508aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a78a794-4c88-4507-962e-09d52b0508aa.tmp
Size 9KB
SHA256 7fa5b3d5f1c2571001032a58507f750024547098c8a50ae613a6e0678c606409
MD5 80d322f53529b827d99073067ef35711
SHA1 19ede58566602835bb9f6a87fc66d87846c3f433
SHA512 077fcbc04a64bc2c7f23b292870446d7b0e08d2c717fb34e55e85b243b10e42514a4ba7c2be32e32cdf48a3e9e616839718101c75ef098af78a0e47da3fbf210
SSDEEP 192:sxZGLWJ/fOsD60t2IuptCHjr6+WNGYYBGIFjIg51J:sxZGqJ/fOsvsAH0Gf5x
TLSH
T12522C8526E38697B8CC7D21DBB55BF53E2F9503155D11E48EAFCC61C04E6ADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c185c27-96d9-4a99-95d3-16e4332d65a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c185c27-96d9-4a99-95d3-16e4332d65a9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 ed0b453b17c8adb272fa83513a8dddd04696811c38ffaec1c52ff69ee318984d
MD5 6ecdcfa4ec375230d09aef7e3a3f0ba7
SHA1 63e1bf4499eea1e29370cf779db6dc9132f5e6c9
SHA512 f03cb54522f293e60bc740fcf7ca9a196bd431c89c1b76e65f3f564ba9938bf19171339caa10cac5801c4f2491f045528da6f9be9894fd5999003b17894eff4a
TLSH
T1F2E026E854CAC22FA64864C703686B4CD3A0361BB2C0B9AE3B04C5C97845484AAD2EA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 08382d551dc39ce799b91fab479c4bca46e237a110b4bf4e356bf66ffd4ab149
MD5 a8f6c36ff036b136e9807af7025c04e4
SHA1 659e724cea44c6686d8101063a1137590ee34b57
SHA512 189763e375d7fc79e7deea46eb2b2e9716a89fd68b038e322faaaa07881b749c31e95613a22fb74b3231492234bda731c07078ecc829fb6ccb38bb6570e12973
TLSH
T195E07DE51ACAC22EB61968C741F8774CC3E1361FD2C8798E1700CDCE780D050B6C26A1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ef4f0386544ef7a2d95fb026114b3e395356c130da11d8c7a2588efb1b4128c0
MD5 b2c78d92c45fc2c2d77b77e68a1e48cf
SHA1 7590bf46906f32d586babe705c5faeadeaab5d6e
SHA512 2ed4e33ba67a3aa81f82d15ecce1852c0b1a7b27d7dedafa1e94a869b995560660820776b7c7ef9f5046abaec938ac0f96ed77e9407c874f3d7937cb9bc56021
TLSH
T1B2519A42D6A09E65E7FD11F0CEFA93A73A7077B12A675D0212D5F8B5AFCAB588384040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d585d3a98d973eba692b3f06879071ca401c4a668561781ed3bd68c7f4b2e7be
MD5 a5e1cc67219a9f05e41cbd5ae67a02e1
SHA1 7bb0689809976e159a3ffe25768985693c95192a
SHA512 e0491e782757e118e82726fbf9399de337eaf842b60b8f9b8eadcacae49bc4e8d4b37a5e8aaf9f6f3e6b4e75dbd7802c316026c703aa10b75fecc7352d1b1e5d
TLSH
T16851BA42D6A05E64E7FD11B0DEFA93A73A7077B12A675D0212D8E8B5AFCAB588384040
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Consumer.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Consumer.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6d72e68a-e398-48ac-a776-e37d041063e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6d72e68a-e398-48ac-a776-e37d041063e8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e0724b9a-b517-41bd-a706-518b441e34cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0724b9a-b517-41bd-a706-518b441e34cf.tmp
Size 602B
SHA256 19f5c91e01f34c8196401f35756bfca7b2d67535d5fa406daddc9000a4f0c6af
MD5 0f1aa0a3da61463425e6b809b7df00ba
SHA1 ed41e8c018466aa598afcd766146001fcf9a96e5
SHA512 34ab7befaefd61ce810b70a3e2c6dfca67c82b2ba06fc2acefb292ff8c614696413a79634cf15ad02d1eb1345cc95a2b958fe1e2365d4ace32566fbf3ed855f2
TLSH
T152F02DF387F4696E8A1192F05A146E1BCE690501435C7D69C5D46E1793E34A5D00199B
MD5 SHA1 SHA512 TLSH

Submit Download

fb94b333-b561-479b-8c77-de8b5812e0b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fb94b333-b561-479b-8c77-de8b5812e0b9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b0b4e7ed-3b67-4dc7-883c-06e4b3f57831.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0b4e7ed-3b67-4dc7-883c-06e4b3f57831.tmp
Size 9KB
SHA256 12d01f04a94b7269e0511e18381d996d3aa91c8a7f364d26a43809aca0609aa3
MD5 252cdca83afc4106335f5203c547f6e7
SHA1 8f1d6da8bb1fa01f03ff01ab9b5a52060384702a
SHA512 d08a95967302b53efb9483b25bc8c4264677632bcee2538ff095c2b5bd1e86da3f228f49cd8f72a316929301a09a82f335cfdebffb74c92dcd212d7758d4f876
SSDEEP 192:sxZGLWJ/fOsD70a2IupJHjr6+WNGYYBYIFjIg5nJ:sxZGqJ/fOskDJH0GfPv
TLSH
T16F12C7526E38A57B8CCBD21DBB55BB43E2F95032A5D01E48EAFC961C04D66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5ff52d7-eb4b-4b50-a90e-034e5979e90b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5ff52d7-eb4b-4b50-a90e-034e5979e90b.tmp
Size 9KB
SHA256 48f5d007e1d26df773c5d1af76b355e9493fff502bd5a2bbbec2751dfd5bd97b
MD5 ba48eafc9e0927cde9d064fd519480a9
SHA1 f1e96ef95dfe3eeb7bc46f4c35127e7b17133e0b
SHA512 b29834772100328dda4327dc95c9356cbe436d47e7a2aa8dfa91575ae29e4f20ca5362eb534a548b37aca55a959b6b86665c869513f276b370d4a7ad09b74a0b
SSDEEP 192:sxZGLWJ/fOsM70a2IupJHjr6+WNGYYBYIFjIgrJ:sxZGqJ/fOsbDJH0GfP9
TLSH
T1CB12C7516E38A57B8CC7D21DBB55BB43E6F95032A5D01E48EAFCD61C04E6ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8460ff0-0fed-487c-ae5b-4e2125e94d3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8460ff0-0fed-487c-ae5b-4e2125e94d3f.tmp
Size 27KB
SHA256 c71413a80d29ad52d5d281f61a9c3331fe1d645e0f6237ef6ce6c78b6168be43
MD5 e736cf2efd48b780187b72d47d558965
SHA1 16998a63ab126c3b65594987bef6fb9178c5a855
SHA512 126296935434b3c667e7822b0e4433bbed353854a0a1c6671e576c8400195a34e24be62db03fd2e93def2d6beed179c40a6e3ebde3863be920fea68147b0ad18
SSDEEP 768:XIyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXIrop1iS:XIyYR7jWv3NpBu1ja/CL8OXzF
TLSH
T1D0C2E82B640DCB7E4FC01A9DDC5A6F9B7E9802C79A548D4047FA944C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c78973b2-5aae-46f9-a5d1-7f6814043077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c78973b2-5aae-46f9-a5d1-7f6814043077.tmp
Size 9KB
SHA256 f667e91c49b2cb729a0b2517343433735660c089d53deac62d04a91f1be89859
MD5 e7bbe7541a0af1ed78d405e5628e5314
SHA1 4f404dec6114c85e8e67cb52f316fe757234985a
SHA512 4fcee18cef7dcb06b058f47b92e7fd096835ff6dc105c58dd702e7dcde3cb9ded31a0f9692b9016c389e3f88c0650ec9bcdec875eb446e4d8918900bfb3593d0
SSDEEP 192:sxZGLWJ/fOsD60t2IupfCHjr6+WNGYYBhIFjIg51J:sxZGqJ/fOsvsqH0Gfox
TLSH
T19222B7526E38697B8CC7E219BB55BF53E2F9503295D11E48EAFCC61C04E66CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 676B
SHA256 6c817bebc26ca62a634be13279bb87f8f06cc04dea4919135cb7a8bcc3c2d3ab
MD5 1e02b7f034045b0bd3d33ac94c7a3cd2
SHA1 002a8bee9c053aa3b6ae4c5075d870339be866c8
SHA512 0599fca05b89e0ecffd622436f9a287ecb4da0be18fb471a29ae09b74b1b8021a2df505e10fdb4e14399f4824581540fdaeffa6fff39eef29d581fa2604971c5
TLSH
T1180121C0D2E644845E8AB682830DB04350B16AE9122D2CF5235DD1F10F88C30CE2FE98
MD5 SHA1 SHA512 TLSH

Submit Download

88396259-4de5-4325-a1b7-fb22ee9dae49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\88396259-4de5-4325-a1b7-fb22ee9dae49.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c112fa3-1afd-45cd-94ed-f075c3df5253.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5c112fa3-1afd-45cd-94ed-f075c3df5253.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 01a96888d2d25365919e9539f63063341f6b47e7eb3474a64a1d61b4867806c2
MD5 6fbcc78ff8c13cae3a6e78b223830311
SHA1 0c35eee9ab824ac62c289389ff79853ca001efc3
SHA512 7625ad2caea4e30aeea0c6ec1ae03c8d7abdae7a1d9c0fd694c691266add679614481306444505592f9c57771dfeb02d3179f6612b073523c75080344ea59cfc
TLSH
T1E641275CBAF91148B3776E5A9BF6686E887F78772E07945D10110E4F0A62B00CCA2B37
MD5 SHA1 SHA512 TLSH

Submit Download