aa55e79a5c05a60380f8653bec7d2d81c0f733369f36c60ed0f433609458ab07

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/10/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Adj Scan Querella-comprobante.xhtml
Size 4.0MB
Sample261030-e1dgvahs2z
SHA256 aa55e79a5c05a60380f8653bec7d2d81c0f733369f36c60ed0f433609458ab07
MD5 a6149fd87c9c93c7e8944bf5de03c189
SHA1 42bd2868c42f3278d13d7bf4c5464a02aaaccef9
SHA512 53588037c45f0aa8f5d29c36f1ab94a1d6644d799980120e2ab6865f035ca4c35493bdb378e84a5cdff4bd3624a7a0a770d1b6935a78acf60b03eb975059b7ca
SSDEEP 24576:/vR1uPTHObSFII+wunJcpW/hQI4kzSTNLmEjGNLqPW/m0AXWuP/sPo4mYl7afOQ1:n6PTHmSFIIHXB
TLSH
T15516BFF837083DD72B6E57ABCE559DEC476A02229E9FA0CD4061ABC70963736DF06805
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1805035633-626948184-3225555471-1000\{6BCFC7B8-9521-4699-B103-3724A105EEDD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Amparo_Directo_Revision_Tribunal_Colegiado_TOCA2780-2026.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Demanda_Familiar_Reconocimiento_Paternidad_Filiacion_OF5083.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cedula_Notificacion_Personal_Termino_Probatorio_EXP2026-8906.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe
476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 3728	476	msedge.exe	81
PID 476 wrote to memory of 2240	476	msedge.exe	82
PID 476 wrote to memory of 768	476	msedge.exe	83
PID 476 wrote to memory of 768	476	msedge.exe	83
PID 476 wrote to memory of 768	476	msedge.exe	83
PID 476 wrote to memory of 3784	476	msedge.exe	84
PID 476 wrote to memory of 3784	476	msedge.exe	84
PID 476 wrote to memory of 4992	476	msedge.exe	86
PID 476 wrote to memory of 588	476	msedge.exe	87
PID 476 wrote to memory of 4992	476	msedge.exe	86
PID 476 wrote to memory of 4992	476	msedge.exe	86
PID 476 wrote to memory of 588	476	msedge.exe	87
PID 476 wrote to memory of 588	476	msedge.exe	87
PID 476 wrote to memory of 2820	476	msedge.exe	89
PID 476 wrote to memory of 3856	476	msedge.exe	90
PID 476 wrote to memory of 1628	476	msedge.exe	91
PID 476 wrote to memory of 2820	476	msedge.exe	89
PID 476 wrote to memory of 2820	476	msedge.exe	89
PID 476 wrote to memory of 3856	476	msedge.exe	90
PID 476 wrote to memory of 3856	476	msedge.exe	90
PID 476 wrote to memory of 3636	476	msedge.exe	92
PID 476 wrote to memory of 1628	476	msedge.exe	91
PID 476 wrote to memory of 1628	476	msedge.exe	91
PID 476 wrote to memory of 3636	476	msedge.exe	92
PID 476 wrote to memory of 3636	476	msedge.exe	92
PID 476 wrote to memory of 2632	476	msedge.exe	95
PID 476 wrote to memory of 1892	476	msedge.exe	96
PID 476 wrote to memory of 2632	476	msedge.exe	95
PID 476 wrote to memory of 1892	476	msedge.exe	96
PID 476 wrote to memory of 1076	476	msedge.exe	98
PID 476 wrote to memory of 4924	476	msedge.exe	99
PID 4924 wrote to memory of 1880	4924	msedge.exe	100
PID 476 wrote to memory of 3764	476	msedge.exe	101
PID 476 wrote to memory of 1420	476	msedge.exe	102
PID 476 wrote to memory of 3984	476	msedge.exe	103
PID 476 wrote to memory of 4052	476	msedge.exe	104
PID 476 wrote to memory of 4052	476	msedge.exe	104
PID 476 wrote to memory of 4052	476	msedge.exe	104
PID 476 wrote to memory of 1648	476	msedge.exe	105
PID 476 wrote to memory of 764	476	msedge.exe	106
PID 476 wrote to memory of 1648	476	msedge.exe	105
PID 476 wrote to memory of 764	476	msedge.exe	106
PID 476 wrote to memory of 764	476	msedge.exe	106
PID 476 wrote to memory of 4708	476	msedge.exe	107
PID 476 wrote to memory of 2128	476	msedge.exe	108
PID 476 wrote to memory of 2128	476	msedge.exe	108
PID 476 wrote to memory of 2424	476	msedge.exe	110
PID 476 wrote to memory of 2424	476	msedge.exe	110
PID 476 wrote to memory of 2424	476	msedge.exe	110
PID 476 wrote to memory of 4192	476	msedge.exe	111
PID 476 wrote to memory of 4192	476	msedge.exe	111
PID 476 wrote to memory of 5108	476	msedge.exe	112
PID 476 wrote to memory of 5108	476	msedge.exe	112
PID 476 wrote to memory of 5108	476	msedge.exe	112
PID 476 wrote to memory of 4660	476	msedge.exe	113
PID 476 wrote to memory of 2916	476	msedge.exe	115
PID 476 wrote to memory of 3708	476	msedge.exe	116
PID 476 wrote to memory of 3708	476	msedge.exe	116
PID 476 wrote to memory of 3708	476	msedge.exe	116
PID 476 wrote to memory of 3804	476	msedge.exe	118
PID 476 wrote to memory of 4660	476	msedge.exe	119
PID 476 wrote to memory of 4660	476	msedge.exe	119
PID 476 wrote to memory of 4660	476	msedge.exe	119
PID 476 wrote to memory of 3724	476	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Adj Scan Querella-comprobante.xhtml
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffed974c188,0x7ffed974c194,0x7ffed974c1a0
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,4381670373982945500,8406881399045951920,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,17281717084980691504,1221280917226759332,262144 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,17026155785560663631,2125518416428146891,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,13913056355501720711,16029274764251807122,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,2810250889154737143,8122491352558579648,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,3838712056665077399,17311200697084619786,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,66960249197352941,13567894078109016963,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,31271659983087336,4469799085003621482,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,13145597718495616137,3828303342663421767,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,2235344668573552640,5101194940290329842,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,17206246922898557153,8987280804575789089,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,9718328969448254426,11589825064084276590,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,9718328969448254426,11589825064084276590,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,11878582073575747311,6158583505832747917,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1072
    3⤵
    PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,16716464688295097676,14448832808263406394,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,15005553991274498383,18413052542994310241,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,9292130255789083639,817127710096206630,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4576,i,13449138177897317230,17647862757726223982,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,3029782970881459656,16649706389591590181,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4664,i,769556133582164835,18318006551891313684,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,9686523438364833684,17188315606863289857,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,1033216078766190573,14770433153663473849,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4496,i,15850192376572157728,4605178934533806022,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,7077642853515515496,5704025890916245064,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5504,i,12180130857212905660,10043937414388866738,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,11757473813150203834,13161450050561362553,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,16227395908811373028,5273742701830434933,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,16227395908811373028,5273742701830434933,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7032,i,1536981995027164832,5531729332263994340,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6968,i,11366336816286805866,18066813369169015111,262144 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5552,i,713400956170057298,14488505229670724242,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4952,i,1593664098781898181,8487779657663299981,2097152 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,8611414939846339182,14514942327720325178,524288 --field-trial-handle=2092,i,7531044683402464602,2904187865964724016,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

118e9645-6ae7-406d-8080-fc1b81906832.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\118e9645-6ae7-406d-8080-fc1b81906832.tmp
Size 8KB
SHA256 374afaafc67c6c4b97819f0fc69577cdc726ac30aae5d9b6a90266aa15b80914
MD5 73785543504b8b68f3485ee64124ea7c
SHA1 35f65b19d43a2c961afddf3920908986e2f7186e
SHA512 3afd54a89887d1e271e50631384572a32e6b07e32003fe99cade9764337a203efa72ccdc13f3c2106ac4baa4797ba3322d981265728f02a8fffef999885974ac
SSDEEP 192:2GN26f15WQmiUyz+ZLzFEkFm2+rhfKXCqzU6:2GN26t0HZ/2frmzU6
TLSH
T104120A72ACA8AC3B5EE3E541F4873607AFB55127EAC57F80E5DC2E2C01DB65C2316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cdff7e6-dbd2-4763-a478-7d6d13b42070.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3cdff7e6-dbd2-4763-a478-7d6d13b42070.tmp
Size 21KB
SHA256 f486274535363cfedb9ce0ed8749f4d12369e6dd9ae9811441836054a72c4ace
MD5 9eef5ca7e0d1897be279979a00a89867
SHA1 c1191810a56a2356a386eaf0aa564e3e55475fbd
SHA512 899734719d5f6d5eb174670f02c9f409c0e8e57f0400c8cffff109aa551c7cec7a77e3c5c2d6f86ea4f6cb403f5bfac1057ae0924a1d94fbdbbd1b4dbc0b196a
SSDEEP 384:OiFIQkUSve8NO8TUNTUlIlDL6yaO0XC2fr4z2IuMtUGIIlv:lFAeNwg4Ty2j4z5rUGLJ
TLSH
T1DBA25B738C98993B9EB7AA40F54A3207DFB48167D9D4AE90E6CD6E2C01CB1DC2347D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4680f9a4-fb4e-45d6-9e0a-dddb1e7d7918.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4680f9a4-fb4e-45d6-9e0a-dddb1e7d7918.tmp
Size 8KB
SHA256 5218e1abeb157a3d6ba7295ddd9a0ec97e14c0ee47525480a9adc76f6cb19445
MD5 484e73e2cfd63b18a222453d3bca2214
SHA1 577573c1165877f52ea3262c1014ab9b8008762a
SHA512 81b6d1b2876a680d0f285a20e66eb992f3db3f9f449c0f0eea1f5205e0a0fa70d94b53156418eacee5bfa1d4d2cddb1be4e8e5317ac6b6561395ed88771d793f
SSDEEP 192:ZGNA6f15sQmiUygEI+uLzFEkFmXG8dU1U6:ZGNA6tGHEu/2LsU6
TLSH
T18702F935ACB86D7B9EE3AD05F4873617AFE5112BA9D42F84D6EC1E2C00D764C2302827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ec8717f-b3ff-4871-bdcb-f0e891f27697.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ec8717f-b3ff-4871-bdcb-f0e891f27697.tmp
Size 392B
SHA256 f8342d7827be5529608502add7e4096cae084726f7f40d842071762e9d67291a
MD5 4bf1dbeef820ba798afc6c7b4bd49edb
SHA1 6b555a994b83d1b43dd0aaa2e25d683ad452d73e
SHA512 6cf5822b71dcecec9b8612dfdb25459bc2274c3dea26216eb6cfdfdc737f6fa8eb60c5a9c92ab7687d51c85c4b005847923f03d20102a39a462f7b723f42994e
MD5 SHA1 SHA512

Submit Download

67638d6c-405a-4eb4-99e5-842e9e891f0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\67638d6c-405a-4eb4-99e5-842e9e891f0e.tmp
Size 21KB
SHA256 b4d845e8be41104392f4166063ebe38b63202e04fe17461f21101dab6148ece0
MD5 dd79b9d79a7cdf393575e60effe20160
SHA1 9ab73d9fefe47775c64c0697012a6864236bd52a
SHA512 c9b243e7e1f727a40ece72ae4a53b2bd646be43bf6b294636b238a776efeb877284d0ab14aca91a2929c2a585981fdf61bab40c33b869ae7bc1c0ea1a45707ba
SSDEEP 384:OiFzQkUSv38NV8TUNTUlIlHL6ya0DL82C2fr5z2IuMtUGIIlv:lFd38wgoyP8R2j5z5rUGLJ
TLSH
T15FA25B738C989E3B9EB7AA40F54A3203DFB44167D9D4AA90E6CD6E2C01CB1DC2347D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f234aea-d415-418d-803f-2edb4944f153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f234aea-d415-418d-803f-2edb4944f153.tmp
Size 18KB
SHA256 9c004d0b12ca68784000a5c469e39d420421c68c6fc8f60680d61ecf37e91809
MD5 79a898a66f37562a067e3b9aab6600d1
SHA1 cc71670e7df15711c74d0e239a8501b09101aae1
SHA512 56d3c259299ba326a62097f6637737d87c9afd41f70b16bf3652e302c2a80852deaa99ec93f4133e67652df1b8a7dcdf746622abbd6ecd1108a02fa55c195a15
SSDEEP 384:VQkUSv08NLwL6ya0DO7C2frkz2IuMtUGIIlv:v0kyau2jkz5rUGLJ
TLSH
T111827C329CA86D3B8EE7A540F54A3603DFB4912BEAC45F84E5DD6F2C01CA29C2347916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4eebdc04ff118e9cd3cbb614d205d2b777bd24419c5ba2ae742de33b0ae98212
MD5 40ad9518d5c77a0ba122e8109cc3c934
SHA1 3770983945ea6e6a8d5f74005f43d42a473cda6f
SHA512 c5dd104df7f9dfc246af8034f366c71afff1236b796e9a095503e2d67aa832edd20512ecc75a53cbdb4618c87af263d88078adcaaf2e02b99f0651281f9fa7e9
TLSH
T1D5D002D5FB40B684D271197B2E6D871DCB0CC7795253F204B25C099A1D8415EA593895
MD5 SHA1 SHA512 TLSH

Submit Download

26ad6ea0-a9bd-4ce0-af39-e673f8c94d67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26ad6ea0-a9bd-4ce0-af39-e673f8c94d67.tmp
Size 28KB
SHA256 f272b2b7f8cfba9f5ebe8eac06c204d36f3eaf6facb25834bc185402f493b8e5
MD5 77ce783823e32ba974fc3e8097d226ac
SHA1 79bd96b388d27be8488602cebc2c8b5b8afbac48
SHA512 43ed4226e232f197cf907138dea3b512da0a937759bd1d96611be91d526c71c5ac2ca3f40b17b0a9ebb0e50e70e106e928bc08c1396ec988edb12d16bdccc238
SSDEEP 768:0WnwK8sN2IsWRmkUQ3z8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fYLl/Yi0EuKroJE:0WnwK8sN2IsWRmkUQ3zu1jaKfYLpY7ED
TLSH
T139D20B3F240CCB7E8FC01A9DDD566F9B69E802C7A6589D4087FA894C02C77EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33fb77c1-e556-4982-b3da-0ea0f9669c86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33fb77c1-e556-4982-b3da-0ea0f9669c86.tmp
Size 10KB
SHA256 1127dec0f4379b8cb2cfee58ad49a284d85626e44f0a0fb01d01267c0dd9faec
MD5 5aa60922f4b43f9cfebd136daeb84a88
SHA1 d0ae2b459fbb23bbdb44794580c03e2711d72404
SHA512 e4c15d9c11d7c7dffe5f8d95861bfdcae1492fe84254c080469a4c801c3208e083e23af94c4ba7e171c0e9ecc11f721374480dc7c6df82c9497b2381c62c710c
SSDEEP 192:sxZSR9OR/f2sQWIdpyT/W6+WNGY0nCUTSmIg5rJ:sxZSCR/f2sQXQ/bG5Rvb
TLSH
T13B22A6516E28A97B8CCBE209BA15BF53E6F9503251911E58F6FCC61C05E77CE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

566bc958-1ba2-4f92-860e-74b3147580f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\566bc958-1ba2-4f92-860e-74b3147580f3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d034f3b-79b3-4344-98db-c88b016c62da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d034f3b-79b3-4344-98db-c88b016c62da.tmp
Size 9KB
SHA256 e7be01ae75d12d7ab972a26b1cb72d976f2b7cecebf1fc374b93c582a1904c1e
MD5 4b33f47459c57ca1dbe3283370581184
SHA1 3d136e5d276b58fa424f89db6e5c664cd71ad510
SHA512 1520bc12afb65cbadf1aed8ce7b1c9bc61b45475ba67fa0755106b5b5d03a53356fdfb3ee78df5cdab7bd54748273a9b0a6e13db6ae926947fd941c4cf306563
SSDEEP 192:sxZHR9bR/f2sPTIdpyT/W6+WNGY0ngUTSmIg5xJ:sxZH/R/f2sPMQ/bG5Jv1
TLSH
T1D022C7116E28A57B8CCBD209BB15BF53D6F9503291D11E48FAFC961C05E76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66acd042-90c7-4094-b81c-73d2324247f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66acd042-90c7-4094-b81c-73d2324247f2.tmp
Size 10KB
SHA256 24f6623a66457b29a771a76a73636fda0e816b25f2142876603f19c22818bc69
MD5 f3addaeb9b1b445f1d32efbfe52023e3
SHA1 2466e3fdab85cce7e6d3330a217d05304d00d74d
SHA512 f2dc5b3d094f7505489ce0aae257629cbbc8213a231e84dcefac2667be8070ec757b946be119d70cfcaa2d878165cfec3b9f5e935b0e289c090714c161c39065
SSDEEP 192:sxZOR9OR/f2sQTIdpET/W6+WNGY0nbrhSmIg5/wBJ:sxZOCR/f2sQMi/bG5BvOL
TLSH
T1F532C755AE38A97B8CCBE209BA15BF53E6FD503251911E48E6FC861C05E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c31e6034de4517206d5367c25b096443c31acdd7facda397f137a5b2a98ec85e
MD5 d4ef39edc45dbaefb155239e1f0ff08e
SHA1 f8092725d93397152b1f0cd8c3f3a031cd1bba17
SHA512 2dc36ace2cd871f82ede6ff4672b2dd4a9cc847afb885ad972b24137b8be777f07ba474e9b053d3eb7823cec96f697039f69e8e654ae119020d6bc9a5c94b0bc
TLSH
T129E0DFF484C8C22EE218A44B2378A34CC3A02A1ED3C16A9A3B04C9CDB006454E6C2AA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 e5767f4a08fce16584dca7c917a7db054e38cd50c9274f03317d3e7d70d137e6
MD5 ab7a156d893792ed82e7af8248cfb997
SHA1 b0cfccc70ace5928768f0883e75bf672b54b7371
SHA512 5526a25008c3b45d7856231c5e17e53b323072d2a10f97b3790b3ec0c70ae5970bb1055b7f445b173ce326d9fdacc6230f03f406778e67a416250afa6089337f
TLSH
T1C421CE8FF7B4501DCF84097668D0D74777B4C88EB1935F82B198C6F65E0A7907144040
MD5 SHA1 SHA512 TLSH

Submit Download

619d51db-db11-4c4a-b8e9-58fa26a71949.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\619d51db-db11-4c4a-b8e9-58fa26a71949.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4b303658-1478-4835-93f9-a199df629454.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b303658-1478-4835-93f9-a199df629454.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

74ab8687-9d39-4335-81d5-17f913a96dcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\74ab8687-9d39-4335-81d5-17f913a96dcf.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

97b6249c-7036-4347-a82c-d33f41060286.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\97b6249c-7036-4347-a82c-d33f41060286.tmp
Size 949B
SHA256 f9068e39fea25bf8c1ffbe3eacafa6248ceb55fd536bf17c19bf1a78e980ba21
MD5 80b00abb127befb643256e6a7b59bd97
SHA1 54d3ad29f25d06dd80b331e5ef5002f94ac61c2f
SHA512 3bc3100ce32c5a3f1c9f89416df95a74695c6887ae4024176c755bc46bde7c6c22931efb9ccdc6f093236b0ef459944d4ee140837e20cd2f98aa998dc1afc5da
TLSH
T1A4115BB3C7E5856E891156F05A24AE2BDE1D0506431C7C1589D4EF2793F3065D00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 72e4b88837f8de165f77f7ae1bf7a57a17e33a1bd6a422b6b7134957de9fe279
MD5 20156412b2496659cbac7d4a17d1ff01
SHA1 5549d52548cdc39219ce47c2ff046dc993dcb641
SHA512 84d46511f4e599dab90c634d94258bfc11a20f2203ed174e97814292cf79311f1b8061c6a101292ba6959ea7e1f15e2bfa46778962bb31abf453c8b6a131aceb
SSDEEP 192:sxZHR9bR/f2snTIdpyT/W6+WNGY0ngUTSmIgrJ:sxZH/R/f2snMQ/bG5Jv9
TLSH
T16A22C7116E28A57B8CCBE209BA15BF53D6F95032A1D11E58FAFCC61C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9827c1600b3ae81467fb3d7de77b2f1826d38d6dd5d8f1db0c43a3ee74c826ef
MD5 351fbbbd68a77931c49f8be9229f9832
SHA1 d01546449690d438780400dffe0fe8089b4f527e
SHA512 924b611d1e8fd3496afa555d51eeb73a25d99137d2bb726119c77fa4fcd8099a7ef1c329f391c45f2c1868f6718d1b9af557fc210b2e5fc85b1b1c2a87ac9f83
SSDEEP 96:KYXWKwA+eV6KewiODaKkEL0wKlyWeNeKmMr:Adt5ZTDJC
TLSH
T1DFE1C11132BB028439BE250891B8972F514232B33129F62B7F7C45679D76F144DBEBCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dce65e12-13c1-4841-99ef-e2ea90dff1b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dce65e12-13c1-4841-99ef-e2ea90dff1b5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f7cb9d53-8135-40ff-901c-290730cd35d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7cb9d53-8135-40ff-901c-290730cd35d2.tmp
Size 10KB
SHA256 2f1709f4d3b4c30fd2ed784279807a1c33c136124dd59550e2316703a1426972
MD5 3f832d0cb4c1a9acf5aa695ee842e8b8
SHA1 4f5e6be41b90f281c4a45611a60af064ae6cc669
SHA512 34c3982040da4a7bbdf3f9b7831057512b76374dcc92c1e98c2eaabcbd41fc695da11e611fdcc88ecbf8a58d7723cc60b9e70f2cb9938f79e8ab5941b4d56684
SSDEEP 192:sxZQXR9OR/f2sQlIdpET/W6+WNGY0nbfhSmIg5/wBJ:sxZQXCR/f2sQWi/bG51vOL
TLSH
T1E432D7556E38A97B8CCBE209BA15BF53E6F9503251911E48FAFC861C05E77CE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d82210c-4871-4fda-b88a-ee325b781d7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0d82210c-4871-4fda-b88a-ee325b781d7f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 629bd71b37876dfc6fbc910947c43780bb8e70a03f6231a6b0387e5f1f63c261
MD5 718e0faa155fd7ba67968c0cb4320eb0
SHA1 fea2f5329921bd77765a0274a9fd165353351172
SHA512 f83c46c191914b127022cd1ce6c946f51ca4bf4234b3dbaec24df69d411a17f1bad0110574762447b49a2068d7b92f717dd254091887c7c31b8464ff46cf37ce
MD5 SHA1 SHA512

Submit Download

a21433f2-ae84-4840-9e8f-4dcf1f895daf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a21433f2-ae84-4840-9e8f-4dcf1f895daf.tmp
Size 21KB
SHA256 dfb3c133ed39027b189ed5c73e6cff3966ee8eee5f30d71dc36361399365d72b
MD5 6d4c03d25a9abb9171c084b808e6fd3f
SHA1 9f0264a3a24e78fc7a4c4a76a695cce9353ec76f
SHA512 1c522951bcb9b905a192a6846a3f4d511c3e923b49fded8c2788a1a7035abfcb5483bbc6c3e12d8e2b68e894516acacefae3e9132b42df68c1b21c1436ad03d7
SSDEEP 384:OiFgQkUSvb8NO8TUNTUlIlDL6yab0XC2frWz2IuMtUGIIlv:lFIbNwg4Cy2jWz5rUGLJ
TLSH
T1DFA24B738C98993B9EB7AA40F54A3207DFB48167D9D4AE90E6CD6E2C01CB1DC2347D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a30b6e60-cf5e-4b0d-a179-0a5c3a75274e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a30b6e60-cf5e-4b0d-a179-0a5c3a75274e.tmp
Size 392B
SHA256 be8ec7d640d5039df0353db3a84bb56c91c97bbf00891edd0cefcd9c2992ae39
MD5 8a19a7f7b1697d1596a9ba98256fd42c
SHA1 5b6f333ecf5b211205ed2b5d2832394207542d7a
SHA512 d343691949c249d601fd41822783b32f2a4f983521d10e1741fc29534c996dc681adeb3216cd588ea468f8a566b4d481e633ee84d5c55613cdd84c001a83d08f
MD5 SHA1 SHA512

Submit Download

e090e8c2-ee2d-4c37-ad91-7b6e9db78345.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e090e8c2-ee2d-4c37-ad91-7b6e9db78345.tmp
Size 18KB
SHA256 3530a322690c3c57c4a762cdcfd6e6ec309c4d0b6f9e6ebc345a6be7a90a892e
MD5 8bcede4025ad216301174cbfa29c9cdf
SHA1 35022af5a3a29c451156110b31271d8e838149a7
SHA512 b2c80e1190cc06bace6d8c5e5191cab187bf77fbea3492adf3a05bd4c610b954ad391f882ca47724eeb9e4673f8c1afda94ea60d6fde9c9306769e79f6c1c3c8
SSDEEP 384:/QkUSv08NLHL6ya0DL82C2frkz2IuMtUGIIlv:B0zyP8R2jkz5rUGLJ
TLSH
T1B0827D329CA46D3B8EE7A540F54A3603EFB4912BE6C45F40E5DD7F2C01CA69C2357916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c5310ba-1ea3-4820-8dc0-36c3d02e5d70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2c5310ba-1ea3-4820-8dc0-36c3d02e5d70.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

LZIMFMQQH08LA7H2534A.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LZIMFMQQH08LA7H2534A.temp
Size 8KB
SHA256 a98794b5725c38ebff2fee587a795b664025ac948d4ca261083051b646b1dc4c
MD5 aa6aa5d623602dc2127a01328593a4e6
SHA1 1a074fb7ca080a4dfcda29e554b1ce2c64ca9a05
SHA512 146ac0ade2eb5f2a1c1867aa33a5a4a88e3914e48d6d2415bfc869d3b985a01d9330ccbd9ba0838d3cba36d6e3e8b4c7a64a1b830c4cd53877c58e669c5cacf9
SSDEEP 48:akcifdOVsJT6J9zAioUCrdLXuHr4N/xfBkjfdOVSHT6J9zfMTdLXuHr4N/xfevjO:avpJ1o9uLKZ3J4uLKWoJruLAL5JnIuLd
TLSH
T1C002D2505BD20696F3F6AA73B4B36740DB3BFD094A188A0F5185420D0D72B059A7EFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amparo_Directo_Revision_Tribunal_Colegiado_TOCA2780-2026.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Amparo_Directo_Revision_Tribunal_Colegiado_TOCA2780-2026.zip:Zone.Identifier
Size 50B
SHA256 86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8
MD5 dce5191790621b5e424478ca69c47f55
SHA1 ae356a67d337afa5933e3e679e84854deeace048
SHA512 a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641
TLSH
T129900206060508084555754417DC4554600E75544D854288BCC189D795C508C8578517
MD5 SHA1 SHA512 TLSH

Submit Download

Amparo_Directo_Revision_Tribunal_Colegiado_TOCA2780-2026.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Amparo_Directo_Revision_Tribunal_Colegiado_TOCA2780-2026.zip:Zone.Identifier
Size 50B
SHA256 86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8
MD5 dce5191790621b5e424478ca69c47f55
SHA1 ae356a67d337afa5933e3e679e84854deeace048
SHA512 a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641
TLSH
T129900206060508084555754417DC4554600E75544D854288BCC189D795C508C8578517
MD5 SHA1 SHA512 TLSH

Submit Download

Cedula_Notificacion_Personal_Termino_Probatorio_EXP2026-8906.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Cedula_Notificacion_Personal_Termino_Probatorio_EXP2026-8906.zip:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ae993fd7-45bc-43e6-9ff5-08472c48a038.tmp

Path C:\Users\Admin\Downloads\ae993fd7-45bc-43e6-9ff5-08472c48a038.tmp
Size 5KB
SHA256 f6aebd009f6d5495c8795cd18e5a47a4586ad401ebab04e234ca77844bf43ede
MD5 d866d34f3ff74a544451a4d6be5c9fcf
SHA1 0d7fec96131189aa323e279a7fb733825041c212
SHA512 6e5830fd7d3f0f7b326c3763abfd7863651a482807786e1910ac17494ed562e261d5199106ab02b4ddf4b967bf6b438bee720f51feaa01445a0d75cd24134b26
SSDEEP 96:D/LeGOt/NHYVpein6f9ec4bwcpWy5XPGVCgAtRAX65lTaUQxui6vHfRPFZs5:veGOty1n6fYc4bPIy5XPGVBKR0pxui6w
TLSH
T1ECB17D4B110757526632DAF588474B81F69F26A2CF3C71783D59BED00281EC4BEDCB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af319330-4ba2-4364-812e-5a683bab6fa4.tmp

Path C:\Users\Admin\Downloads\af319330-4ba2-4364-812e-5a683bab6fa4.tmp
Size 5KB
SHA256 57a7a36df4c1d4e5e68e972bcfa0bbd1d4cf0dadeb62ca6a94834300c801a54e
MD5 143b5a05d25c3ff2eb24e8541ab06151
SHA1 dcc6ae9c865f817828fe117d411a81630ed31f6e
SHA512 841327ebdd228364726a15b2f75a38f7fc6ee54fab17c3d0234c9d17adbf27a18341893568fa5e656c566123fa1c900158fd2cc4a4ab41f6f0c55b960d604998
SSDEEP 96:7cigetef9hBRJqj7s/Hr/UsrA3zG+pLHp518Ua47Czvgb8v+7bPogMnjUeC:XPtef99JCeDsDG+BHZ8UEzgIvPnY
TLSH
T189B17D2DA36705D8D003337CCCC09AE54ABA93E6CE90A5ABCBB6326DE472DD85F85141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download