13d9dde3f222c008ac95771cd0f757470192450414f1ee0cbb964866225ff62c

Analysis

user interaction
yes
max time kernel
200s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Archivo.conciliacion_COMERCIAL Uspec.xhtml
Size 4.0MB
Sample261024-c1bbdahs9l
SHA256 13d9dde3f222c008ac95771cd0f757470192450414f1ee0cbb964866225ff62c
MD5 f3167336cac0c178f224d5a526d787cd
SHA1 9701aa4bc1720cdd27e457abc29435c5108aa34a
SHA512 c216b47a6bd005b31b91e8c32260a793e0997f269921811edfe2dec0a38b85ac28342aab9ef8f5abe0b24c1fc1695416b58d2cfb3d1a15dbb3096323a87547f8
SSDEEP 24576:QvR1uPTHObSFII+wunJcJi64pNABU4IKQUCZvdg7/iYCWTl5Wv5BJyjHlK2Dn0uD:O6PTHmSFIIH/
TLSH
T1CE16AFBCF5147EA6266E636FCED5B8ED13B12A538B8794CD81A9B6C30493734FE11804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3588	WScript.exe
3264	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{24BAC88B-7907-4E30-9BC5-508C20C346BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4312	4808	msedge.exe	87
PID 4808 wrote to memory of 4044	4808	msedge.exe	88
PID 4808 wrote to memory of 4544	4808	msedge.exe	89
PID 4808 wrote to memory of 3860	4808	msedge.exe	90
PID 4808 wrote to memory of 4544	4808	msedge.exe	89
PID 4808 wrote to memory of 4544	4808	msedge.exe	89
PID 4808 wrote to memory of 3860	4808	msedge.exe	90
PID 4808 wrote to memory of 408	4808	msedge.exe	92
PID 4808 wrote to memory of 408	4808	msedge.exe	92
PID 4808 wrote to memory of 408	4808	msedge.exe	92
PID 4808 wrote to memory of 1744	4808	msedge.exe	93
PID 4808 wrote to memory of 1744	4808	msedge.exe	93
PID 4808 wrote to memory of 1744	4808	msedge.exe	93
PID 4808 wrote to memory of 960	4808	msedge.exe	94
PID 4808 wrote to memory of 1428	4808	msedge.exe	95
PID 4808 wrote to memory of 960	4808	msedge.exe	94
PID 4808 wrote to memory of 960	4808	msedge.exe	94
PID 4808 wrote to memory of 1428	4808	msedge.exe	95
PID 4808 wrote to memory of 1428	4808	msedge.exe	95
PID 4808 wrote to memory of 1768	4808	msedge.exe	100
PID 4808 wrote to memory of 1768	4808	msedge.exe	100
PID 4808 wrote to memory of 1572	4808	msedge.exe	101
PID 4808 wrote to memory of 1572	4808	msedge.exe	101
PID 4808 wrote to memory of 3456	4808	msedge.exe	103
PID 4808 wrote to memory of 3692	4808	msedge.exe	106
PID 4808 wrote to memory of 3692	4808	msedge.exe	106
PID 4808 wrote to memory of 3692	4808	msedge.exe	106
PID 4808 wrote to memory of 416	4808	msedge.exe	108
PID 4808 wrote to memory of 4632	4808	msedge.exe	109
PID 4808 wrote to memory of 416	4808	msedge.exe	108
PID 4808 wrote to memory of 4632	4808	msedge.exe	109
PID 4808 wrote to memory of 4632	4808	msedge.exe	109
PID 4808 wrote to memory of 2888	4808	msedge.exe	110
PID 4808 wrote to memory of 4120	4808	msedge.exe	113
PID 4808 wrote to memory of 4120	4808	msedge.exe	113
PID 4808 wrote to memory of 4120	4808	msedge.exe	113
PID 4808 wrote to memory of 3496	4808	msedge.exe	116
PID 4808 wrote to memory of 3196	4808	msedge.exe	117
PID 4808 wrote to memory of 2880	4808	msedge.exe	118
PID 4808 wrote to memory of 2856	4808	msedge.exe	120
PID 4808 wrote to memory of 2856	4808	msedge.exe	120
PID 4808 wrote to memory of 3408	4808	msedge.exe	121
PID 4808 wrote to memory of 408	4808	msedge.exe	122
PID 4808 wrote to memory of 408	4808	msedge.exe	122
PID 4808 wrote to memory of 4188	4808	msedge.exe	123
PID 4808 wrote to memory of 4188	4808	msedge.exe	123
PID 4808 wrote to memory of 4440	4808	msedge.exe	124
PID 4808 wrote to memory of 4440	4808	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Archivo.conciliacion_COMERCIAL Uspec.xhtml
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffca980c188,0x7ffca980c194,0x7ffca980c1a0
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,1371840292554147183,9858096307448305005,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,4232818442680802803,18243247592066897937,262144 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,3837152337884941240,1992195920981752291,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,8775571397589630058,16944745149940503379,2097152 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17208433206625082504,814485886480120686,2097152 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,4568879866607623289,2972619229128915731,2097152 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11655381152424654986,15228326220212128751,2097152 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,4272380283323963228,2761774057098678497,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11958427208197651276,12883169138821519235,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3825492443696508120,500175563476924433,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3825492443696508120,500175563476924433,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3952,i,9075925476088924198,9679306837311236634,2097152 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,4185174817153171874,9902935485224585551,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6468,i,15502928055943339832,5005744615184860582,2097152 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,15597556134792371954,14015531426733079296,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6196,i,8931955349804073114,3742134556340994866,2097152 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,14978777501650037595,3020988787735974268,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,13680918158847830993,8992184471455063027,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10882689657733520479,10879022589171384642,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,107732505411784498,7942322187784094538,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,12593644865417970040,5765993384335395880,262144 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,11294943148604902192,1412646464304184398,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,7314740523907432896,8966577745066211064,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,9867444492199900425,5424164532722572582,524288 --field-trial-handle=2324,i,15644904894521104860,12693880804341810224,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3740

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Querella_Penal_Fraude_Generico_Abuso_Confianza_TOCA6067-2026\Querella_Penal_Fraude_Generico_Abuso_Confianza_TOCA6067-2026.wsf"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3588
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFJI9BLW.tmp"
  2⤵
  PID:2972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Querella_Penal_Fraude_Generico_Abuso_Confianza_TOCA6067-2026\Querella_Penal_Fraude_Generico_Abuso_Confianza_TOCA6067-2026.wsf"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04f25cdd-e613-41d4-bd06-c85b8b9d77cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04f25cdd-e613-41d4-bd06-c85b8b9d77cd.tmp
Size 18KB
SHA256 22ae8dc284099f4d2a7ff3a5f14c9b16f9992d91c1a5456e413ccd3ba191b209
MD5 e2393881e59d1023c891796991a85206
SHA1 bb223572d608dfe5f7ffa85bdb2d50a232df8a88
SHA512 93cc200c4e9e187b7efcd8181c88cca2db463d5427ec8a849d0cf4b7a54450af81b84899774de0c63d4e834fde654c62839f4213311b1512304735e5cf98eac0
SSDEEP 384:MQkUSvMsNSb7GjUbq4X2h//TyxL2ITIIlY:MMBwMXG/bOL5TLu
TLSH
T163827D35ACA96C779EA39541F14B3603CEB0C127DBD96F98D6D96B2C01CA2EC6307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a645eaf-97d2-45c9-a2c1-0d53340bc680.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a645eaf-97d2-45c9-a2c1-0d53340bc680.tmp
Size 21KB
SHA256 c7f24137889bda41e59583779dd85f732ea007aa9bf92e50e110c0f96d0ca38b
MD5 c16b6c813c4b724515ccbe16b40309bf
SHA1 fa0aa9983927e8218d386d2a368c9d06d11ac20b
SHA512 2d7cd1ce0b3cf7198602dc35da46d84611291b07f2e618573a2f507e39c68ab8d017a1010f20f94f0baa7abe9e28b906b27ab7dcb557512883c21bed266d7dcb
SSDEEP 384:SiFqQkUSv+LsNx8TUNTUlIlb7GjUbr4X2h//TyEL2ITIIlY:ZFS2CwgNw1XG/bnL5TLu
TLSH
T169A26D369CA4987B9EB79A41F14E3603CEB08167DBD5AFA4E7C96A1C01D71EC2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20c56764-b1c4-4766-a154-6e7f1225dd99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20c56764-b1c4-4766-a154-6e7f1225dd99.tmp
Size 8KB
SHA256 cfd9aab3af76ef5c2a80273f4cc578126c2532ffc061f36cfb6b441f640e69e8
MD5 45061a3cf2cdf6b898b39e7623070f65
SHA1 7e0e202e9d0f23b137898385ba6abcab5fc107ff
SHA512 ea01b83a643587c22073bd96abb66c8fa527dd8da537cf7c45c04a0a29d40f64fcf4ed336835997e6f306b44cc2bfe3376ffdbf6fdce6b13fe49fe78e7c4f2ef
SSDEEP 96:8qONkzQsjpfbUdH5ih/cIPURHl8h4otop5djDNBQP4v+Y1xf//ojdoxyqsoe8x2A:nONT6JUGQmiUyhTCo//TetINxQqpU6
TLSH
T102121B35BCB8AC7B5EA3A945F08736138EA44127DBC56F94D6DC2B1C05DB2AC6307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

363589a0-6422-494a-82ec-070d2b3d0a2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\363589a0-6422-494a-82ec-070d2b3d0a2c.tmp
Size 18KB
SHA256 414d29510f6b737a5e0e06f7e5101c748e9d1de31487485d4c8c89e468a09dec
MD5 1dbfcc8a3c7fbe790e21a63df63731b6
SHA1 c59ffeb65d67297ad260fdce23e649b39a541d30
SHA512 2f5b3c953521b4703e6c9e854b9058885ad50409f4e331cbbc8bf64bfbb229a11a1eaea9cd2fb9d22f2f8d48c13d10bce14a613cee658e68074b585381b7e067
SSDEEP 384:6QkUSvnsNSi7GjUbT4X2h//TyxL2ITIIlY:inIwdXG/bOL5TLu
TLSH
T1EF827D35ACB96C779EA39541F14B36038EB0C127DBD96F98D6D96B2C01DA2EC2307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37d79d23-3602-4f6a-ab37-2f241e848242.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37d79d23-3602-4f6a-ab37-2f241e848242.tmp
Size 21KB
SHA256 0dd3d4e09c3d8bed5c76bc69765efdce52025ebb4c1a1c8b09720a0d80a4ed39
MD5 e3e76019c858fc8e297d23fc943b3d1c
SHA1 9dc07a79b5d7851847c8c07a1da5d462bf808da8
SHA512 3f93d2fec4418bef537dfdae38b45f9e5f2028810604968922a4fd2a8f0d45e5e50a4e4404533d522cf4939831ee85184385c495a4b29d0b0e69904c87ad5413
SSDEEP 384:SiFXQkUSv+bsNq8TUNTUlIlb7GjUbq4X2h//TytL2ITIIlY:ZFpeLwgNwMXG/b4L5TLu
TLSH
T16BA25D369C94997B9EB79A41F14E3603CEB08167CAD5AFA4E7C96A1C01D71EC2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f9eea0e-ed72-4c75-bbb1-7d868f1e95c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f9eea0e-ed72-4c75-bbb1-7d868f1e95c2.tmp
Size 18KB
SHA256 063578ae295ff53938483a5183b25fd8141077ae26f1167e04fdd1a60dd5c7c8
MD5 06ca1d1c5c3140d13dc654d258784ca5
SHA1 283dc05f7445abc75fddd20afb323219cea6866c
SHA512 04e42ae87f135e23dd3c6c83f4535dc537f6de5160106a8f7f50ef7350d6114599dee5479e0603b4ab9dcc0a9e60e5443de4565b9ca3c76e066225e7c2f292b6
SSDEEP 384:UQkUSvMsNSu7GjUbq4X2h//TyxL2ITIIlY:EMYwMXG/bOL5TLu
TLSH
T1B6827C35ACB96C779EA39541F14B3603CEB08127DBD96F98D6D96B2C01CA2EC2307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6452dcbe-00e1-4558-8fb7-36c71c0ff079.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6452dcbe-00e1-4558-8fb7-36c71c0ff079.tmp
Size 21KB
SHA256 246c233660b08b885950bd6e55e567ab17e44b2bcb309f34695ad4040815f646
MD5 ca49ec710b412e2882b5bd46affa4173
SHA1 1171fbccb1c2667a1c2ef3ac9ec6d55959dd9b21
SHA512 eb2b81ab52d93af104c6722c8ae4aaa3de0920f5bde2d6369fc460e4b05aebfc80063aace4ad893427cbccaec5102bd5e58eb2d401c406a9e32c5556da8edd8c
SSDEEP 384:SiFgQkUSv+bsNx8TUNTUlIlb7GjUbu4X2h//Ty0L2ITIIlY:ZFIeCwgNwYXG/b7L5TLu
TLSH
T158A26D369C94997B9EB79A41F14E3603CEB08167CAD5AFA4E7C96A1C01D71EC2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76561863-e013-42c8-9984-014bd1b17755.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\76561863-e013-42c8-9984-014bd1b17755.tmp
Size 21KB
SHA256 fa36badb424afa5b6eb6a185cc4c075c3aa7e3c1545e114bd99de8dec91961d1
MD5 75fa09fde16a42141be3fefddd9db997
SHA1 6bc17bb434943738320c5cee54f976f9f6fcdf6c
SHA512 8fe62e8a8a57c05f27598cd3f4a783b9bbee0c17e7d3ea7c9d1692ab7945d626e38ea4a7b0322ad5778465ab126b2905ef7f885ef48ca84b7dc791840fddde94
SSDEEP 384:SiFHQkUSv+ksNS8TUNTUlIRbGGjUbL4X2h//TysRL2ITIIlY:ZFZd3wgswtXG/bvL5TLu
TLSH
T1D5A26D369CD8987BAEB79A41F14E3603CEB08167DAD5AFA4E7C96A1C01D71EC1307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9adb4b95-a90e-4945-8372-8777f9491cfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9adb4b95-a90e-4945-8372-8777f9491cfe.tmp
Size 21KB
SHA256 e3df948c254d729464d2e7c4cb45f7a7d7d2fc00bd757501e75ce20eb5a62fae
MD5 84b2b28ca993565306202f3ea7d2a9da
SHA1 4f3e7916c1d1a1d8aa9a6bb26376ee29b0395a40
SHA512 d700c90593b02582c6727a733ec7b5b6900854e7c6f6b351f49d005c8ea9b46670403c0b378568c67fdbaec61ac0c96f1f3fdb5c1e285a35352949e5208e0614
SSDEEP 384:SiFhQkUSv+bsNx8TUNTUlIlb7GjUbF4X2h//TySL2ITIIlY:ZFTSCwgNw7XG/bxL5TLu
TLSH
T11CA26D369C94987B9EB79A41F14E3603CEB08167DAD5AFA4E7C96E1C01DB1EC2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

6442308b-eb54-42b8-8eb1-764a69482075.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6442308b-eb54-42b8-8eb1-764a69482075.tmp
Size 10KB
SHA256 1ae5060395852decbf28e5c64fbb022df33b18c96011d2b47996e2dbf1343e50
MD5 100a080138912ff424f9451aceda979b
SHA1 914fbf5fc34b6d5c6bbb4137676e84e5508267e1
SHA512 4b6962473f2a5792b7300d0f6d9548f1cc631bb367dbd87679443e69cbd6d9ca8f72ef7b3470f9eaf31b105a3b25879ce3e6697f65a3e1e530f25be422c89e2c
SSDEEP 192:sxZu2R3nE/f8sWuWIdpHcHW6+WNGY36gR5/XIg5ZeHJ:sxZu29E/f8sPX8HbGXw3m
TLSH
T13D32A616AD78697B8CCBE20AFA55BF13E6F9503251A01E58A6FC8A1C05E77DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7abe77a1-7a6d-4ee4-9db2-f5d94df11a47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7abe77a1-7a6d-4ee4-9db2-f5d94df11a47.tmp
Size 10KB
SHA256 f7156f7a678e796cf19b2cb828894899da34aa6b9ff1829b304626fe935204e4
MD5 435106d0cba6f42c1213c7f150657314
SHA1 f15ae14db1fd38d8e6956928fc0546f4fa3fe095
SHA512 318aa0f0637d72fa3d9ebb8fca570c15846e2d7a7b8d454af9e5cbc19b334dca817eb686c1121c05a1cf7d72c0da6fd0542492a2bf20be54b31f80919ca2d435
SSDEEP 192:sxZu2R3nE/f8sryWIdpdcHW6+WNGY36WMX/XIg/HJ:sxZu29E/f8s+XOHbGXD3R
TLSH
T16D22B6156E38A97B8CCBD20AFB29BF13D6FA503251A51E58BAFC861C05E66DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f5f66e2-0af6-4d94-add6-d0f6117a510a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f5f66e2-0af6-4d94-add6-d0f6117a510a.tmp
Size 27KB
SHA256 44ca10f224e3a1fd1e80b79f1fc0e407c8d9802234c81f064a10cc507cdf96b8
MD5 0da4d98d06e6c54f823895af69d5b2b1
SHA1 1304750d329689f42915c20f6849a196a2e184e5
SHA512 288d2d1be33c853db3bc8bc1f6c2cae7f011e98a76215ceb3562bb2a59113c4f8510f1724aa412acd52941781383accead040ce7ec2e2839ace292a2c0c977e1
SSDEEP 768:U+Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/rrobJ:U+Klm7QWvUYe0u1ja8/L/E/YbJ
TLSH
T1ACC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

933add2f-452f-44ca-8d2c-71bb5f5a2020.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\933add2f-452f-44ca-8d2c-71bb5f5a2020.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b8af87a-7ab2-40d6-ae4f-42f9a7471c5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b8af87a-7ab2-40d6-ae4f-42f9a7471c5f.tmp
Size 10KB
SHA256 9a3235b16633293d3925c2290c24d27871234db598b2a29ca4ede1c1261dfa86
MD5 074ffce826a48bacac6937824f0e9f20
SHA1 32734c1c89f0ed60738ed997c4efc0b2de9f59a3
SHA512 371689d462ec9dc9bab4e7776c85ef37064d1b01dd15e632483c00f4e9343bed96ee0fa545efde4765a25f75f5154f467f66b373302712d39b2c1c135e4b618c
SSDEEP 192:sxZu2R3nE/f8sWuWIdpdcHW6+WNGY36UOX/XIg5ZeHJ:sxZu29E/f8sPXOHbGXR3m
TLSH
T12C22B715AE28697B8CCBE20AFA55BF13E6F9503251A11E58B6FC8A1C05E67DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1ee487249aa1ac15fdecd0f21ee5e0ca4dd3355a8a4733d9b48789db7970e334
MD5 ef7319c5435d850e06587e1be5e89e63
SHA1 1370274dd68cacacdd66d3ae748e2b90ce99e2a0
SHA512 413d71e636b52027548249f2b9fb00dfbc0a2fc914dbc1a73106e958add007ddf36ab68218d8b438a4330b1385c308679440c1a3fec2747e41505595fd2d90ed
TLSH
T179E0208454C5C73ED3047C874754574CC780372B9ED0EA8D1714C9997449D40A6917D8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 427b6e89bcc915f900bb70996f4f8758f39a545f0f9758911a06cf353cd49580
MD5 c30df47d838fa7b9653a971cdcc814bd
SHA1 fe4e2f8f686c935cd6c72261770b6c6056502f96
SHA512 899b4bb3c1e54459212000ee987b0d8eb9b1ca14ddcbcec3e1335b097b017de78458ec9ca060e74ee4bf4a65c5e3348f69c3f801f6dea326eb6557be345f5ad4
TLSH
T1B551C5C10D7301A0E78B82700CD3D9837634A87249832E1B1EE7D4BB5B4E7AA4DF6344
MD5 SHA1 SHA512 TLSH

Submit Download

766004bd-b3cc-4490-b7e9-4de14176c55c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\766004bd-b3cc-4490-b7e9-4de14176c55c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

688ca709-2da7-42b8-9d28-bf31ce6f6145.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\688ca709-2da7-42b8-9d28-bf31ce6f6145.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e4f2bc4c-67d3-420b-8c15-60f8710fbc10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e4f2bc4c-67d3-420b-8c15-60f8710fbc10.tmp
Size 949B
SHA256 4bcb8988755020e441cc4fd681ff51ea2bea6119a2c25815ff9b16e120bbb723
MD5 38364d591a345444a9aaba32b0b30ffa
SHA1 5075daee95cfc3befe136e45bd738bbc2622dc23
SHA512 b5f40e09a37e46afd377e858f72c81d45fd3803c6d6c2bfc6fda706e6fb3502f1b788030e4fa7e5599b4fa004794510ca2b4c4553c9a5d94272d4cb4ffbc898e
TLSH
T1AC11BDF3C7D585AE891157F05A24AE1BCE1D0505421C3C19C9D4EF27D3E3075E00155B
MD5 SHA1 SHA512 TLSH

Submit Download

ee92a44c-7b69-413d-a87d-4de0191c4d71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ee92a44c-7b69-413d-a87d-4de0191c4d71.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 579e8843d7cb2efc8b6dd1e2861f038a123ae3b9edc82c1086f60a4f0c3f7283
MD5 a2a46f27ea0a39083f0768bf9f241414
SHA1 b06c7f832c7e498ab23ff62f710b19a77d3afb6b
SHA512 db229253737b282d3c7ce25a920dd2ba529cf7d184b144824639369da801410a4cd93db0b278a5b730cafbe217b6864ec22c1dc7cd6d720e9657263bf7659497
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayL2xMwuUUNb4PgISINK9s1uNxmdYHYca:KIRyKqoy+h2KyQpCUKrySCGwK/au
TLSH
T1ECB1610131779250787E754C41A68B6B864132733019EA2B7FFD50B68E6EE118DFDADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c892e532-ac6a-4af5-88de-4943025cb992.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c892e532-ac6a-4af5-88de-4943025cb992.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d22545f5-64b2-44f8-bd19-5d5eb7fe88d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d22545f5-64b2-44f8-bd19-5d5eb7fe88d7.tmp
Size 10KB
SHA256 830bc7a5269e99c19051d0553ee8c93ac17c238318137fcb5d510af656ad56a9
MD5 9c7c6b86817e6024645cf840537331c7
SHA1 febca279f0e96e317e81f4303c6c59d7d6868dd0
SHA512 9c8396a4a10739c375039f34fc4ecc359ac964719b6f16742c9b6e04a5c920dcc6549fe1f473c4f9892c70639d6ed9bfb255eb00e0451b92a84b08a0e5fbf418
SSDEEP 192:sxZu2R3nE/f8sWyWIdpdcHW6+WNGY36WMX/XIg5ZoHJ:sxZu29E/f8sHXOHbGXD3g
TLSH
T1D322A515AE28A97B8CCBD20AFA59BF13D6FA503251A41E58BAFC861C05E67DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f64737fc-0500-4e4d-9fde-a4e650b7ccf8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f64737fc-0500-4e4d-9fde-a4e650b7ccf8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7a175b7-6ecf-4ed2-987d-bf9ba8a9ac3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b7a175b7-6ecf-4ed2-987d-bf9ba8a9ac3b.tmp
Size 21KB
SHA256 14d3812d8c3bf3916e274b3c8645d90380cc8a3b92d4ac71eb53adde7004f482
MD5 5bc020871c7317f88780ccb3403b4e8b
SHA1 5d94a9017eb625b1cb04c97baa0adfdcc93649b4
SHA512 738aa7cafd3a097f8880f355838c37f2dc4686b616547cf358682efe8610f66351bdb3b91066a2a83b7f885baa978bd2ea2751ce4a48d15617b6408ae4a6c29e
SSDEEP 384:SiFXQkUSv+rsNx8TUNTUlIlb7GjUbu4X2h//Ty0L2ITIIlY:ZFpqCwgNwYXG/b7L5TLu
TLSH
T186A26D369CA4987B9EB79A40F14E3603CEB08167CAD5AFA4E7C96E1C01D71EC2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9bbb593-1b4c-4c90-8d2d-a5091b08e0bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c9bbb593-1b4c-4c90-8d2d-a5091b08e0bf.tmp
Size 8KB
SHA256 b399b5349d844c73271edc0bf2b94ea559ee995b78ae9f6120b2a5a5a5f4c9fe
MD5 f82c7e049858a46e0b3711d8ea89799f
SHA1 7c4998d6da910f43965fe107c4c20e9d9c4c55c1
SHA512 660af33b61b638505676b2a388cba1e0d10165b8670e80da932c060417532f92d6096193ab9974953019f8c8f95bfc6d370fcec4f4d228f07117ba4bd9bbe2ae
SSDEEP 96:KqONk1QsjpfbUmjH5ih/cIPURHl8h4otop5daDNBKP4v+Y1xf//ojdoxyqsoeQBc:BONl6JUm0QmiUyeTso//TeQBCJVU6
TLSH
T1D502E939BC786CBB9EF3AE49F08777239FA4106BA6911F84D6D85E1D01C725C2303822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42000ee6-ebfe-4c25-8b38-6122d33c6adb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42000ee6-ebfe-4c25-8b38-6122d33c6adb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8c0f040f1e71879c92f8f26e6413c9617f56f2ddcd6f8cebfee39e61c455477f
MD5 5eea6bccdee83f51bbd0d5fbb17d708c
SHA1 8b5585885c108b01fb16a0fcfb59b2349fe9b2e0
SHA512 3140a32f1a7003a6281760177bcdbf6acf3f93f350d3b8e68e753d9371c8fa9f3b8172d722da496c9b33dfa244b15de12d39ce2f0911daaf9f7d2a6b70961342
TLSH
T19D412859AAFA1148B3B77F5A9BF7A86D487BB9372E0AD05D10110E4F4633B00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

4dba7cd9-beaf-4ab1-b16f-e6986e863e68.tmp

Path C:\Users\Admin\Downloads\4dba7cd9-beaf-4ab1-b16f-e6986e863e68.tmp
Size 5KB
SHA256 f991e323b35157608976e23ab32f0304333ad272ef7a2e9b99e5ab583a24a305
MD5 7db37d3761ad0301fd44253edee0b237
SHA1 5e79b68f6eb3f31a4691ec4c1de517535eb8349b
SHA512 38369c96c6aabf429c4cf6a837fb6a4404301ff6e76aa2a21cc1d9a86de714cd80717c5a85d9ab2420982a07a65f5b85e86e22bcd464c8b7464fe4890bffbfea
SSDEEP 96:Aa86o/Q9PsIU+atDA2H7kn4xYGuUCdlLZKHyW5aAXbJzXbY0:A29tU+at5Hwn4xYGedlFsfaA1Dc0
TLSH
T19AB18E36683B6E7AED2C6CF191406A509060BE088999D170EB308F081F599F9E6CD9F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download