dbc7fa1086aac7c184a3dbe3a8b2ca6695f34fb1f0332157e473a1fb88df21de

Analysis

user interaction
yes
max time kernel
899s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fwd BOL125 Auto.POPAYAN 12-183.xhtml
Size 7.4MB
Sample260820-xp3lpsfc98
SHA256 dbc7fa1086aac7c184a3dbe3a8b2ca6695f34fb1f0332157e473a1fb88df21de
MD5 8fd5f8abdb8783f33a864a64e1699c1e
SHA1 6a8692151d80b33549b41372638035060774d43f
SHA512 c9d7589d918e48fb63c03858b50ffd214219a71bc86a2c214c5909f8c30b4e945ffa2a18d0dc4dbd2a05957dc8da22336df0de4b2f49d14e09a96bc0d45bbba6
SSDEEP 24576:zJRm1LWdVHNjC7nvSUVsTe8XprmzsO4cOwubAxVfLGl44YCnfOKOwNwMbU1fhQkI:ce9M7K7G52
TLSH
T1FA769EB875487CA25A9F17AFCAD67CEA53A712736B8759CD403876C30923336EF06844
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3804	powershell.exe
1068	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TelShieldVHSXE4.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TelShieldVHSXE4.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TelShieldVHSXE4.vbs	wscript.exe

Deletes itself 1 IoCs

pid	Process
1540	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
5040	WScript.exe
1984	WScript.exe
1540	WScript.exe
3052	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 2556	3804	powershell.exe	155
PID 1068 set thread context of 3044	1068	powershell.exe	157

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3900	cmd.exe
1360	cmd.exe
2020	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3312	PING.EXE
1360	cmd.exe
3892	PING.EXE
2020	cmd.exe
4352	PING.EXE
3900	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5004	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317261817825443"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4EE64C58-3DEB-40D9-8680-EB2A374F4C21}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4352	PING.EXE
3312	PING.EXE
3892	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	RegSvcs.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3032	3028	msedge.exe	84
PID 3028 wrote to memory of 960	3028	msedge.exe	85
PID 3028 wrote to memory of 5004	3028	msedge.exe	86
PID 3028 wrote to memory of 960	3028	msedge.exe	85
PID 3028 wrote to memory of 960	3028	msedge.exe	85
PID 3028 wrote to memory of 5080	3028	msedge.exe	88
PID 3028 wrote to memory of 5080	3028	msedge.exe	88
PID 3028 wrote to memory of 4992	3028	msedge.exe	89
PID 3028 wrote to memory of 1320	3028	msedge.exe	90
PID 3028 wrote to memory of 4992	3028	msedge.exe	89
PID 3028 wrote to memory of 4992	3028	msedge.exe	89
PID 3028 wrote to memory of 1320	3028	msedge.exe	90
PID 3028 wrote to memory of 1320	3028	msedge.exe	90
PID 3028 wrote to memory of 3168	3028	msedge.exe	91
PID 3028 wrote to memory of 4660	3028	msedge.exe	92
PID 3028 wrote to memory of 3168	3028	msedge.exe	91
PID 3028 wrote to memory of 3168	3028	msedge.exe	91
PID 3028 wrote to memory of 4660	3028	msedge.exe	92
PID 3028 wrote to memory of 4660	3028	msedge.exe	92
PID 3028 wrote to memory of 1872	3028	msedge.exe	96
PID 3028 wrote to memory of 1708	3028	msedge.exe	97
PID 3028 wrote to memory of 1872	3028	msedge.exe	96
PID 3028 wrote to memory of 1708	3028	msedge.exe	97
PID 3028 wrote to memory of 2348	3028	msedge.exe	99
PID 3028 wrote to memory of 1824	3028	msedge.exe	113
PID 3028 wrote to memory of 2464	3028	msedge.exe	114
PID 3028 wrote to memory of 2936	3028	msedge.exe	115
PID 3028 wrote to memory of 2228	3028	msedge.exe	117
PID 3028 wrote to memory of 2228	3028	msedge.exe	117
PID 3028 wrote to memory of 4108	3028	msedge.exe	119
PID 3028 wrote to memory of 4108	3028	msedge.exe	119
PID 3028 wrote to memory of 4108	3028	msedge.exe	119
PID 3028 wrote to memory of 2708	3028	msedge.exe	120
PID 3028 wrote to memory of 2708	3028	msedge.exe	120
PID 3028 wrote to memory of 3012	3028	msedge.exe	121
PID 3028 wrote to memory of 3012	3028	msedge.exe	121
PID 3028 wrote to memory of 3012	3028	msedge.exe	121
PID 3028 wrote to memory of 4228	3028	msedge.exe	122
PID 3028 wrote to memory of 4352	3028	msedge.exe	124
PID 3028 wrote to memory of 1052	3028	msedge.exe	125
PID 3028 wrote to memory of 1052	3028	msedge.exe	125
PID 3028 wrote to memory of 1052	3028	msedge.exe	125
PID 3028 wrote to memory of 2416	3028	msedge.exe	127
PID 3028 wrote to memory of 3000	3028	msedge.exe	133
PID 3028 wrote to memory of 1504	3028	msedge.exe	132
PID 3028 wrote to memory of 3000	3028	msedge.exe	133
PID 3028 wrote to memory of 1504	3028	msedge.exe	132
PID 3028 wrote to memory of 408	3028	msedge.exe	134
PID 3028 wrote to memory of 408	3028	msedge.exe	134
PID 1540 wrote to memory of 2768	1540	WScript.exe	135
PID 1540 wrote to memory of 2020	1540	WScript.exe	136
PID 2020 wrote to memory of 4352	2020	cmd.exe	138
PID 2768 wrote to memory of 4868	2768	wscript.exe	139
PID 3028 wrote to memory of 3292	3028	msedge.exe	140
PID 3028 wrote to memory of 3292	3028	msedge.exe	140
PID 3028 wrote to memory of 3292	3028	msedge.exe	140
PID 2768 wrote to memory of 3804	2768	wscript.exe	141
PID 3052 wrote to memory of 2508	3052	WScript.exe	143
PID 3052 wrote to memory of 3900	3052	WScript.exe	144
PID 3900 wrote to memory of 3312	3900	cmd.exe	146
PID 1984 wrote to memory of 1144	1984	WScript.exe	147
PID 1984 wrote to memory of 1360	1984	WScript.exe	148
PID 1360 wrote to memory of 3892	1360	cmd.exe	150
PID 1144 wrote to memory of 1944	1144	wscript.exe	151

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Fwd BOL125 Auto.POPAYAN 12-183.xhtml
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c0,0x7ff93af1c188,0x7ff93af1c194,0x7ff93af1c1a0
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,9247640058735962761,5984887908215379404,262144 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,11696555675369037677,10392947143907112185,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,12502528548159433293,18414044720687440591,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,13483198126787466298,17947500755602149398,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,12896770635497609379,12216039249112182756,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,1932707694513665222,6510128148432186281,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,14305260762940114867,3887830449079782031,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9165920745379909623,18026923234784692208,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7606877337182268745,13805990029088426549,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11981012118842779970,7369224035556208656,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,11981012118842779970,7369224035556208656,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,9130647725596551233,15283502314932085381,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,18307209870559431372,690681679563023887,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,17781188125542651444,1445991725191009434,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,130863980909902444,6639931213600829112,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3956,i,41777980436408694,34602181753804503,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,3069259401297946602,6366858303979930035,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6768,i,8119164362976847877,7494589923676751374,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,10502426790398022305,15365781573158782480,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14538026849115085585,18390484206346879453,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14538026849115085585,18390484206346879453,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6852,i,8202897037494916516,14685486094309169370,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3588,i,10364613811513709506,1353701764885809820,262144 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,1565532031752084327,8241653467006366486,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3264,i,7764408596197202630,6134800538113423432,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,2495779261173865656,12520719285737799148,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3400,i,18322039777621017177,1961026457263504128,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7124,i,10304882302242246290,759138129947206434,2097152 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,253778977071835557,18349265404863154638,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,14981174558817609157,4038306094088770524,524288 --field-trial-handle=2244,i,3700464031903805107,7648925431186783067,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2188

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.wsf"
1⤵
- Checks computer location settings
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFIp5asVz.tmp"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\notificacion_51734.html
    3⤵
    PID:4868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -NoLogo -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\7D94AA7F.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:2556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 4 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\Temp1_Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.wsf"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4352

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.wsf"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFIp5asVz.tmp"
  2⤵
  - Creates a file in the Startup directory
  PID:2508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 4 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\Temp1_Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.wsf"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.wsf"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5040

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.wsf"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFIp5asVz.tmp"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\notificacion_51734.html
    3⤵
    PID:1944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -NoLogo -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\183A2A7F.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 4 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\Temp1_Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.wsf"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1b8670f90996f99545a359788fc5d532d9f23aee856a494ae16f3b2eb3eb7d66
MD5 3473df85b20ed25665d4bfd6e4859e7f
SHA1 1714d755b1e5af68fa150bbcf4aeb788415e3696
SHA512 82a6dea2559b7e6784dd0f7b9ec38756dc7c7471cac37842e5f77d28fae3fddfa00a995136cd838396b8157fa5783b676969632048d27ca347b0fdb10b5daf08
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T18FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

6d8e268e-ac04-4292-914e-8f245506256f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d8e268e-ac04-4292-914e-8f245506256f.tmp
Size 12KB
SHA256 2a4359c00657b377cac02aee277dfaf065d87c939aee358089d3289be62d7aa8
MD5 005a2f034c36ea716ca1af7fdd85bb26
SHA1 fd83b7b1243e0291bacb532826b52a048a7e8995
SHA512 3b47b929b9a4c77c58a7e99a6927e9823510a071cf309a51e1ba4ae68f47a5c7d1b57f12a54f7417a09447f1c1a3d1d2a3e2e4de40cd58e823aae4a74bfe3a1c
SSDEEP 192:sxZS5RNyM/jK1Ml8Mk6/fW/s28aNVwIdpdxHW6+WNGYvrRj5jIgrJ:sxZEXM6/f+s2h57HbG+p9
TLSH
T11C42D8116A34A977CCDBD20DF951BF53D6F51462A2910E44AEFCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 95b55441f3b46860d9043148bc742e31bf49e5bf9455fab0095de2e966ddd3d3
MD5 c12d22f3fc1bd002d04f47640c107d3b
SHA1 6c4fc65175faeb86748823a527a066729b52cb68
SHA512 f4a4eee41a98cd65aab0b3b2ff2eab12b2edb70ef4a8881940a47d320c8d216f836367a09a4a4e3245c6c3d11ce1b2d34609afc6c025aab7d89294ecd291639f
TLSH
T1A9E0DF1C12CCC3AC8F80A68BA0FC739BA1B47107D7BCD86A3304A0942E60800D64C1B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b4ba46eee92e349de29f5ff0eb53474a8c1eed2cc454b73180e46725a4624eb0
MD5 7ba2753117e115edbfd72fe332229aac
SHA1 bc4ff40d5520c74a61524f43275fbca385b98fee
SHA512 f57c80a7f7da66f5ecd057fc8f518a6cc3100a006537fa043626c28e6ac03df7a441c33fcd382ac362b89503cb56a311b98a296d874dd0544c692a914897f33b
TLSH
T10AE0209404CDC31DEB0075C7716C438C5164360B93C4EA5D7700886477415DCE2C1574
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c0cffca360fc489ac79d417350fc4955e72db435ea32e7869e77516ec9bf529
MD5 d8e9a69cd6fe5189a2e2c5202bad30cd
SHA1 e0409b988dcc41e38e84b339b0a17b5d9b5fd7d7
SHA512 df9a156a8273dd96d70bf4e6de9bbdea22d5213004b0e280669a53e10706092ab9452a35d7eb66fa242de27620b5414c2d1d91f9d3f38efd016f72953cb06047
TLSH
T11981C6F52A3200A0E720057D94F96E6A3A75A7EAFB0B5F5A71807C706D16BF20079D3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5877bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5877bb.TMP
Size 3KB
SHA256 139dab88e2700b589f3ba320371d38dfd9d69b7e105cb94afa195835f6ceb973
MD5 ea5353d7b256fb37499114d5988413f6
SHA1 c76f69e1c0327761b600ab68922621cbabde786e
SHA512 3261fd5c68a09f9b2f39d6a66171119e2fe6e0033cf26441f97d8ee57fb453193e0c1cac1fee3d57e5030534c088c2145fb003a2340a24604e6bc5dcebfd7e6d
TLSH
T1E781D7F52A3200A0E720057D94F96E6A3A75A7EAFB0B5F5A31807C746D16FF20069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6cb3c5963e2f134188eef8b6fd259cabc59b8955a52c3b41978a371d92a61519
MD5 6e8839ba4bd9255b8ad120ff79947dbc
SHA1 85f9feec0339c9211062b9bdf344fb4098b67d17
SHA512 f62809f45d1f32a4cbdf1974554b5041d890707ee03183f594feb1383d75e5ab0e4029bb0d9817c953048ac7cbfe46e9212f64c2cd89d154853a471c1d078f00
TLSH
T161117AF3C3D5956E8D4516F05A28AE2BCE2D0606821C7C1A89D4FF2BD3E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 909fed9d023af359006b70bdc30f6f79bc75d964829b5687a28b20ce3b4d6f19
MD5 38a23534cc2f4d8d64335d2ddb37d2ea
SHA1 2a679af25f6d64911bc0a8efc359f24ae8d5fa43
SHA512 741cb06cfa4a57ef4e2043888fa98e40684c3a2c8e7f0a5f403dd99bfd61de7bdf56c98ef728284176760235c912decc253634627e9e7e8751288353cd311a51
TLSH
T128119BF387E5816EC90116F05A28EE2BDE2D0606421C7D2989D4EF67D3E30B5E002A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3776d34ac78c58ed62875e3ca75dd061ea3467242e20128d4a2d3d42ecd425c7
MD5 aa107c3321ed27616f1456de14bcafba
SHA1 dd9b1dc1ad3eb7a14b67a8bb37db368f1c774b98
SHA512 3942e7fffe84bd47bb30d37a6b3b396e23f6ddfe21bfa812b8b1ba2bc9e0671ea56609a51da5fddc7ea5c41c9b2bb9e75bed0429a545ed96dac20a1f5cce7cc6
SSDEEP 192:sxZSRRNyM/jK1Ml8UQ496/fW/sK8q4VwIdpHxHW6+WNGYvJ3j5jIg5pHJ:sxZsXqO6/f+sK52RHbG0pF
TLSH
T11052D711AA34697BCCDBE20DF941BF53D6F5547292910E44AAFCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 da850f96a85807a5dac556b5e0413b864bd844f4f041da5b1afd5da4c713c279
MD5 789583e0dc3ebacd8c47385991efb33f
SHA1 beae95eacb42ef364d1e355a1c4447bbefd98594
SHA512 3c390ea7ff8b78c0520ad0b9b9ab388bab199456233065e9dec7143ee9d5e18931973b2bca26dfc8c4d7ebc6dd91b6eeabbee231c1433606ea58dccf29f8cd62
SSDEEP 192:sxZSRRNyM/jK1Ml8M96/fW/sK8q4VwIdpHxHW6+WNGYvJAj5jIg5dJ:sxZsX16/f+sK52RHbGnpB
TLSH
T1D552D7126A346977CCDBE20DFA41BF53D6F5547292910E44AAFCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 13a065fd79049483ae282d62a9baa265c237096f5c78e6b8e982c15b694bebb8
MD5 4f7a382d8b4e2376b2ca5fe37d8d691d
SHA1 8e83e6b196f88b4e77777f57582e819d3dd0ea5a
SHA512 ac9cfe36b11169cf21263f4c47e6f0e5f9a034561c4f5edad7224934944c7974623b9da455a5b4b1ccd5f3508ec221c11a2c71f97e9f1c70c2a3e2f478fdd6d1
SSDEEP 192:sxZSHRNyM/jK1Ml8UQ496/fW/sK8qaVwIdpHGHW6+WNGYvJ3j5jIg5pwBJ:sxZuXqO6/f+sK5omHbG0p8L
TLSH
T11E52D811AA34697BCCDBE20DF941BF53D6F5547292910E44AAFCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1df92606550e10555216c5491bb6bcd8f19f9a03f934c402fc3452640d45da74
MD5 9452784d878f6c2b45131f358b6720d9
SHA1 7e1cb61a1ba7b46e3bcb0076097cf3ca996af1f3
SHA512 78c5b7a679e0a82e84cb1704153b97c89c6185ba1fef974f35da240db13ce9a2a271a318b9b3a7951885ed477d414a7deb891166190a1d26636adac5a75bb328
SSDEEP 768:c2seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp7ro+L:c2seJ3xWvhfynu1jaVcL88pIS
TLSH
T176D21B2B280CCB7E4F844E6DEC266F966EE801CB57944D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 6bb92b5727137ec06e819ce6c9eb23329d66f2e3368dd180b256588b10ed46db
MD5 059edb6b264c56d482f9251fab550e2d
SHA1 8e5ec8bbe1627e54dc7f14ca8ea46da6edb7ca95
SHA512 68f6643e0879505f27531a0833dcb085c54000f1778ea06099fa323dd69b00578f02693490cb42f4cf63099b67aab70da646319597e9f607f50afa2c5d00214b
TLSH
T1A62165489E90891FE568857B15B7B8F03370CDDC572163631C6C35751E2179D3A476DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbfae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cbfae.TMP
Size 1KB
SHA256 d0b601bc73b9a9f837df5a44da07a788077fa3cfefa25d7303d634d497a498f2
MD5 ac9604cf500262f39e8275be7f505b78
SHA1 1b09e3e25967b4865ff7855d339232453f52902c
SHA512 3eb21bb9f4b7df10b7ace55d1defe3105a7975b1d061ef568b2526aaf994473ae1037684e23f599d34dbce37eefa1a7feaca4f67685b34d18cf0fb39d305806d
TLSH
T1A02114854A918E1BF894517B1EA3A4F4B330CC006322B7D3697C25795D35B9E5A0B1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7b6a0cc4458b41882e57ef37e2547e8b2ef1fb799b00b5e906f77896ab2ec516
MD5 272d4e6b459f630a295445556acba455
SHA1 b66edc9b4223c57f4942793c745bcce777137a81
SHA512 ceddd599b1da573165443c4d20d5ce0a0f2c12f19c04f79c288b31136c768f5d0089ae606e97494871b87d426afbff64ee7d6adf2fcc2766c8ed39d55b65e847
TLSH
T196E0C0762DD72414BDAFC3D12030C490064A789CE901FC0E551BF6C3107231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 20da829029e37fa36b0b8eb69346cb20a0b3dab941d5f01bdcc9675bcf9e59e0
MD5 c5ee8c3afc999ec4dba36ac67c12974c
SHA1 2d0d7be4041a4a0863a86292b5ba1a2f48bf0543
SHA512 5b59f60b309a27ec34ce567b92a164172092e982b7045a1f208fe3bc70c8b240fd86faac5a79a1be1b8e5e4cf188cef94b64a1e8bf3a1c2fa35d97ea63621b60
SSDEEP 96:KYH+KggmSRkVBnTfkvTqP1ZkK9B1/kJhBKnh5eleKm0l:49SRkVBnTfuTq9ZdB1/+hBKnh5hA
TLSH
T108914242363F02022CBE294CA296A9764F4175A33554A4FF7FB844A30E66E110DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

930d67ee-6401-4540-826b-6638ee9fc1f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\930d67ee-6401-4540-826b-6638ee9fc1f9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 064ea8d5bcdaeb3c0a857d39ae3c6fa24d0daafe74062f6cf48b1041b62c7411
MD5 67a98bfbcd5fc7ebc87a01e99f174191
SHA1 9b8fff2fdbdfa4ddf44a02809f4b2a270851754c
SHA512 682276c299e5887ce7c6ce4fdfd707fb78d571c5e1864756c18d5ec19aba306afc72da3d8e7951abe3b5280cbf5aef8763b8d85da210a2b2e10da1f80d4a3fdf
SSDEEP 192:upm+xasuheOwQxMGsNVZQOmM7VrJQmiU10yB4MTq4+FdLkxdtSJrB8z1PqNsL:FZcIhsNVZvb7lnxuJd4xGJrmysL
TLSH
T1B7626C715C345C3BA8B3B245F48B32138FF4D127A6C8AB54F6ED6F1C01DA6A8131AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 56a92ceb92710a2e8056565fb20fbeaa5f573d97de46ee0c9501e29e06a2fbbc
MD5 a6597f0437fc62ac511d6578618745ef
SHA1 28eca81a43e08984d1b8c3be927640a66cf153b6
SHA512 7f035746906278dda6ef3c4920bd5561c7303b23158d2cf271e78f03c6735a00fbfacd23c794c9c8075d38b706c50896c2ea4dc2fca8e740ee708a7abd6c7221
SSDEEP 384:3BiFcZcICsNk8TUNTUlIlQvb7l8bPP2Jd4xGJrEysL:3oFKCXwgabuPAzhEysL
TLSH
T133824A735C64983BADB7BB45F48A32138FF48167D9C4AA90F7DC6E0C009B2A8131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1982094d4210e55e2ebc6aa5b944033db532818f22a69c76fd8ab21218115d3f
MD5 9d755e0ccd2d6488fb12fbc8ad09f15b
SHA1 ab7af6f1fdf63fcdd67564d381c40cdadaeec591
SHA512 0b9cd2dba826d0139a0d309d30e4bbdbe925e87a6708600f9cbbbaf12bfb42d0a722129de1defc05293c207598a142757705edc84695f070a63e864f534d5523
SSDEEP 384:3BiFPZcICsNR8TUNTUlIRQWb7lIUiJd4xGJrbysL:3oFHCIwghbr0zhbysL
TLSH
T175823A725C64983BADB7BB45F48A32138FF48167D9C4AAA0F7DC6E0C01DB2AC131AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc3b9c5cab807d7fc250d61d91baf02c81722b0327f9abaa73b4020590f90ce0
MD5 f4790518a5189f15d66427ab7a34f59c
SHA1 df29987296d44286c478156aa76983366a9f689a
SHA512 fede0e6734f5d77a6738708d3b6aefa538064c375e916fd3dd7cce0a193f32770e1a51c9be0582bb7818511ba245422d1eeb372c19fdf24b0fd6ffc4309ea0f3
SSDEEP 192:lON7Zh6vMtPQmiUyc2ThTq4+FdLkxw847c64U/u:lON7D6UtRyTSd4xKSU/u
TLSH
T1D9020935AC786C7BAAB3AE46F48A37171FE4117FA5D05B54EAE82F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d01a141890549c87f504ea13c24874a840ed328e63170e6b08b5eeb2856930e2
MD5 1cbc4cfcc90633e6c82d973cb29592ba
SHA1 883ce97f0a4766446ec01f2b9e22693d0d316577
SHA512 416e91857a1632e71116ba21027f924628c8bf3452421dc83fea72f6d06478673b611e286ecaf4f6f5e64e5353ad10208ce82571ce5e56b1eedb1879f53f2d23
SSDEEP 192:3ON46vMRPQmiUyl2KhTq4+FdLkxdtSJrM80IPqNU/u:3ON46URRhKSd4xGJrxyU/u
TLSH
T14A120B31A8649C2BADA3B646F08B32175EF4C16BDAC5AB54FADD3F1C01DF65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 95e64f62e4152e8305d9ba8e48b392ef6bf710b30b4bfa77235c492d99893aaf
MD5 9a8678683b3c7f326716e9f5816f23d2
SHA1 0f2b8f95da51d3dfb5d19b4ccbfb9b7fbed04cb4
SHA512 48dffa3058f818623d25649458480191e4b02308aa21befb66f8483b53511860b59971e687c7fffc4a2a65c8ccf963e8b20c9f41190a2ee23eb0b075a77e8f63
SSDEEP 384:3BiFiZcIlsNv8TUNTUlIlUvb7lnPP2Jd4xGJr8ysL:3oFQluwgKbpPAzh8ysL
TLSH
T131824A725C64983FADB7BB45F54A32138FF48167D9C5EA50F7DCAE0C009B2A8131AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fa805c649b553be347c0acfb2a89e066c369c0431d8d87893166f7e0e13f5443
MD5 f881fbd05528d3f26da08b69363dd7ac
SHA1 5190017763352cdfa92ebb7d2d063b1102206def
SHA512 98eaa4a10656cbfe39e74aae9e39f1fda52631bee2689690f89b58ca8736c5c03f8b9dbe6cf5f2718170cf9d0f462f6e0009d34804ca28ef226757782f972ab2
SSDEEP 192:uOm+xasuheOwQxMGsNVUQOmM7VrJQmiU10yB4MTq4+FdLkxdtSJrB8z1PqNsL:+ZcIhsNVUvb7lnxuJd4xGJrmysL
TLSH
T1F3625C716C345C3BA8B3F245F48B32139FF4D127A6C8AB54F6ED6F1D01DA6A8131A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 44f3857f50d560841f81090668e3a275e7836fd58b4682f9f02a677ba0b194c9
MD5 7383c1b994d496b2cd25aa9feae94952
SHA1 597999b78878be3f70ea836fa704bccbc8315f26
SHA512 348a16ef32e28d282db9cd004a9ada35488cbddaacbd1a5d63e458293717b71491345ac1c1bd7f8ad5964588d7eb7e59175111ae44cfc30ba420e07083d0554b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 45c9cb5a29d4ca75652b060c88d708db6902b6665f5dc5ef5924be6513c1ca30
MD5 ae2a978adaad95eb094d3f1242a72287
SHA1 d6f6f8cd3afe21c65f31aead9d887de82c0b20d6
SHA512 a3463542659746babc1c967969801afb507bdd1b85ee9fe3f3c11adec55e0ebe14a1f0617c4be7b9b37b0d48bc7ab6d44f4d02cb4f834eb50f9a8742d57b8d6a
TLSH
T1DEE00255530000BDC238033440471F701FF2C02001A607465970525C1D323043F35FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b6202.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b6202.TMP
Size 392B
SHA256 4afe41cae4e8bd38aac6674b816d8a8a55666084c9efd36db5c2e0b016384c6e
MD5 5da5355480a9f7609ed9bd1bbc5b9922
SHA1 18f54b9a51ba717258953c9d0a236061e32f1a9d
SHA512 d663745a2e8111a738277e168bb1c578320b0665296e1bee7cbd13e5b0b5f4cac1e321f19fe177e374b1fde03afb8b851098ad93d70744cbc2506d6d9dfeef29
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e38c940d511ec8941807d4aebdd669c0786b28503826b01654a9ece70fc26aa0
MD5 2649d63e7b802be49ee0016b16b557c7
SHA1 b6754fbd44f727e663d51968770069a7bf208cd8
SHA512 cc4f04314e8ff38a816beeeb1f01af3b10f272450842c43fc0fd1bb68cd5095f029595fb8e940085d48e6d63b8ae71a815055f0b3f0e1e83271f13096217aa83
TLSH
T1DA41285CB6F91148B3B76E4A6BF3A86E447EB9372E06D06D00110E4F0B62B40D8B2777
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d06bb033be46e5fa93793e4f3b47eebcc113dfa515969a0fde2ffdc3f3aea364
MD5 aed0970447bf9bfb7f9160d6b4de7954
SHA1 20549bd568b233b1c548de33c6f74a8fe9edf95b
SHA512 3c72f9b5a8395d48ff486c73c397df49f25576536eff16a375987e8ecf6c137bfce15fd78698bf60e0d541cac3fb226ecb3fd444b36f6eca3e42af4810bb6180
TLSH
T1DF21AB27B39C8961CC86163A509D9C217676C3C7819FDF9F7FC4D604A07F988CB21294
MD5 SHA1 SHA512 TLSH

Submit Download

183A2A7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\183A2A7F.ps1
Size 3.2MB
SHA256 bde88d31a0745347f5030ecea7a9bef51b6dc11e443c731789a6f98031b3b883
MD5 8b35e9f32fcffccea1893faa0d6c0c0a
SHA1 2d933eef9fc4049c97453df8f98ba3c25cf680f4
SHA512 98a6014314c0bcb09a4d3d1496504761fe0aa12325ebc16495a466dcd2727cad9e5b424ba3b713307c87a9043d5e32478379b7d512118a79bb82c59376c837f2
SSDEEP 49152:vrdsgveEu1o7RfzFZpHKojN+CxhIKYNhs+as8jXiEWaSKLX:j
TLSH
T134E512422F2ACCCD6928FB42ACF20F5E1183A3A036BCD1256A5548DFD89E74F7497D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.ps1

Path C:\Users\Admin\AppData\Local\Temp\2461617F2E113CFF\script.ps1
Size 2.4MB
SHA256 75bf5d082e276c73943e8687a01dd284d692c9df403ca35dd56e9406cd60e2b3
MD5 3db55f833fd080ac5908c74186f3a924
SHA1 cba37fa17de807b14feaeec3372ae83abf036479
SHA512 a3be881eb0de35b5d7053c65535d13b05e29b40dcd2673ae52162a41528a048bacfb88b75a7f32c594b97fc98fe20750b6f005c5333bdd97f247b8dfb455538a
SSDEEP 49152:8Xvh7vnI1QvCNPt0v9+9wEoZJEFoLJ87sX/1k4dEqtx5:8Z8aKEY9wEDoL6qTdEEr
TLSH
T105B5CFA09C1F833BDB9B8D0510FBFB176E26B7437AD7274AC8709051CE59A10AE56C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D94AA7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\7D94AA7F.ps1
Size 3.2MB
SHA256 b37a3833a88c59b871d8f1d405386ae0263ba478b58e0fc246a3429174d4d15f
MD5 0623ca9b995958435989425329cf9d52
SHA1 d56cc73467a4d49870ec908e4521cacaf9d035e8
SHA512 64da790467113bcdbd4f3e0fd40d922d1dc9d5c74a5a32b2db1277506c446fa13f23cad571ecaf884f342d8b66f0ac06ba7669221c806b873e107be6928388c2
SSDEEP 49152:vrdsgveEu1o7RfzFZpHKojN+CxhIKYNhs+as8jXiEWaSKLr:3
TLSH
T1C9E512422F2ACCCD6928FB42ACF20F5E1183A3A036BCD1256A5548DFD89E74F7497D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nrdoyf2p.h3m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nrdoyf2p.h3m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

notificacion_51734.html

Path C:\Users\Admin\AppData\Local\Temp\notificacion_51734.html
Size 27KB
SHA256 e3badb04e2c8fb5180845614bae57659ada64e89b7b9d1700157d158868ef616
MD5 a28796305f5c803448544be1891e90ed
SHA1 54d50b5e161fbf7f6b50e5a50bbb12b4ed1e7e0b
SHA512 ad2d57daddd3e56bcc4716040b8733dffcd44320522bc3bdd1ab74ce461576f3e8e5ed7aa9afc016427f9a2aea3538bf6b03e9072e0b92855be077d9fdacf5ea
SSDEEP 768:EQFNboQLQWqASvy31AM/0GwRHTWngL7L31:EQbox21AJRig7Ll
TLSH
T121C2AE76D5C8012674BB90E4B062FFDBB091966BC8A7DA74DCFFE656CEC29A0C601704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~WRFIp5asVz.tmp

Path C:\Users\Admin\AppData\Local\Temp\~WRFIp5asVz.tmp
Size 3.2MB
SHA256 3155f4d59a00b5c3c33d0c1bb248a151f2b773b9773971fe8307213d9a36d743
MD5 2ce0dccf9b65adbeb22bd05093c2d15c
SHA1 edd414cb335fc7ae463315370e74694883dd17a4
SHA512 93634812e46a358d328cd81a9fc8447cf6bd6e66bb11160a191495fd3f4c61724113a8c69da0f76e96affc89693132dd9520c145180749cf98d2debddf3e1fb3
SSDEEP 49152:WUpE6Rnby3GJPCnvkGBnw/dOPzfAv4s6iSLFk94fciQWSVUo:H
TLSH
T177F512813E6ACCED6929BA435CF30F6D4183B3A471BC91216B608CCF94DB71A78A3D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~WRFIp5asVz.tmp

Path C:\Users\Admin\AppData\Local\Temp\~WRFIp5asVz.tmp
Size 41B
SHA256 6f6f5aa9fb75d062bf022fa6c13128b9f6811e5f1302f91765d79c27a6af8714
MD5 55e74ba168aa68143d53c71ec99590b9
SHA1 5b7bb86849429d7961b675ea511c2b64865f057c
SHA512 96b8c7c5c4c4bc43079039824341e554defa8a72b1426e01e1e7139a706b9952ac5cba9872877a84d3f3cd90e811d7a02ff26b473f6843575dd2ac427bc78ab3
MD5 SHA1 SHA512

Submit Download

TelShieldVHSXE4.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TelShieldVHSXE4.vbs
Size 3KB
SHA256 f02bc56927845fe2d95ad861b4a0291e98f45c4683775ab44301c9ae25a265d8
MD5 802d70ba9535c6f9c94b5da3fe0c7208
SHA1 7da7c15835d1564146c47d6a9faffc3bd851c2da
SHA512 cc2e7ffc5460e642a732287a55bf8f6c3ab64ba2a09d08bc350b215690413815d49efe04b59214272cba2e194fe8203ea315f4c905a874ef6cbb1b53f323bc4f
TLSH
T1866112F16E2E036817A105D54A1FBE3BB8A4C46F587429893BF129DBFF22105B93261D
MD5 SHA1 SHA512 TLSH

Submit Download

Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip

Path C:\Users\Admin\Downloads\Juicio_Especial_Hipotecario_Vencimiento_Anticipado_EXP2026-3876.zip
Size 5KB
SHA256 00a926af914af0219c19f77922c4497eaa0881d218085a6f4fb418c4bfe44f34
MD5 1f7f068a195ae088d0b2c83083e52f7b
SHA1 811b5376669365617f324b59596e8b800dfd26b9
SHA512 93e167dd10b4e56aff46360e425a05d5899b05d2ba6d5682594cc4f4434d9e1924da31061746b4ee53ab80eaf121b02d947be7e881950b86c1135d66e85bdd53
SSDEEP 96:4K7V1oL3cjscOQ49EsYVKExX91VYvmx26ia6+apnaw3OHC3QclDtKx:x7McoTQ490VKMYeqa6+snaw3OHSxcx
TLSH
T1C7C17D4673ED18DACA07F4B4EDDB0174888203697921078686FC9F404E08153ADD6EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings_VHSXE4.xhtml

Path C:\Users\Public\settings_VHSXE4.xhtml
Size 3.2MB
SHA256 429f34d07608562fcb759161ba2bcd49fdb24b1976d3bfe9b8131d55e086d938
MD5 7b0ff9a1d6335ec6b15da024c13bf107
SHA1 fd6e3202f318b5b81bb1e6c8ed9be2a0e9fb2cf9
SHA512 5e6ce2f97d78d047fa628fb8850535aadbf8c6f09026b805991251a7f16097354d0571ec760ea1c1dfc8409d3ffc1e4326d3595e577f3493bf2a9f03c92ece45
SSDEEP 24576:NPhTC1NMgolbXtApmFCDyHddEEVpuAhQXzt/lsV76ChnljQkqGFRBk+bXioupemD:q4HLjVp+ZOjl9Ugq3ST/EZEQ7HJClC
TLSH
T1A5F51247DAC922D49284250BB7EF130E2BF74F201C195568CAFFC9DAD16EA54227BC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-433-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/2556-432-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/2556-423-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/2556-422-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/3044-443-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/3804-421-0x000001B1F0F40000-0x000001B1F0F48000-memory.dmp

Download

memory/3804-368-0x000001B1F0FD0000-0x000001B1F0FF2000-memory.dmp

Download