asyncrat | 69ab7ab815add4bf63f5fa11803e18ed0138497bb38db8911372c8e443a53739

Analysis

user interaction
yes
max time kernel
1020s
max time network
1010s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Informacion de impuesto de industria y comercio periodo 2025.msg
Size 76KB
Sample260910-tbx8aadf62
SHA256 69ab7ab815add4bf63f5fa11803e18ed0138497bb38db8911372c8e443a53739
MD5 4ae0e876424f33bd207f964cc80b5c94
SHA1 3350a5714b36710b21ef92fc3114176465dd600b
SHA512 18d0123a578a944a896648f46a8ba045ee29d1aff4a869b127c975c2314f44d1d0b3564d6fd81dd8200df6599c164d6f95a6fe9301814754f2c2603c757ed65d
SSDEEP 1536:rO0wEkXcfvoARVzJ2VhLky2mLS44WKW+dF2jPOS88e6c/:rYEks3o0zQz2mWaGq
TLSH
T1F47366152AF61215F2B3AF3549F5546789777C82AC34C94F3189330E0AB2E41ED62F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware colombia10jj defense_evasion discovery execution asyncrat donutloader loader persistence ransomware rat spyware

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

COLOMBIA10JJ

rpg2.duckdns.org:7777

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/3356-1011-0x0000000002AC0000-0x0000000002AD2000-memory.dmp	family_asyncrat
behavioral1/memory/1856-1014-0x0000000002800000-0x0000000002812000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/3356-1010-0x00000000003C0000-0x00000000003D4000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4188	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5292	vijewyufveonabghulluonouceyasi.exe
2892	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Name = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
222	drive.google.com
44	drive.google.com
45	drive.google.com
60	drive.google.com
73	drive.google.com
136	drive.google.com
220	drive.google.com
221	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2012	cmd.exe
2508	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexpress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexpress.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe
900	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4576	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335292895693241"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D0750BEA-9AEE-4825-948B-725B72DB0F95}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5384	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6108	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
60	OUTLOOK.EXE
60	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
60	OUTLOOK.EXE
60	OUTLOOK.EXE
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
4316	chrome.exe
4316	chrome.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
60	OUTLOOK.EXE
60	OUTLOOK.EXE
3388	msedge.exe
3388	msedge.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
3388	msedge.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
3452	7zG.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
60	OUTLOOK.EXE
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE
60	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 3388	60	OUTLOOK.EXE	96
PID 3388 wrote to memory of 1288	3388	msedge.exe	97
PID 3388 wrote to memory of 4800	3388	msedge.exe	98
PID 3388 wrote to memory of 3656	3388	msedge.exe	99
PID 3388 wrote to memory of 3656	3388	msedge.exe	99
PID 3388 wrote to memory of 3656	3388	msedge.exe	99
PID 3388 wrote to memory of 2180	3388	msedge.exe	101
PID 3388 wrote to memory of 2180	3388	msedge.exe	101
PID 3388 wrote to memory of 2132	3388	msedge.exe	102
PID 3388 wrote to memory of 5096	3388	msedge.exe	103
PID 3388 wrote to memory of 2132	3388	msedge.exe	102
PID 3388 wrote to memory of 2132	3388	msedge.exe	102
PID 3388 wrote to memory of 5096	3388	msedge.exe	103
PID 3388 wrote to memory of 5096	3388	msedge.exe	103
PID 3388 wrote to memory of 1836	3388	msedge.exe	104
PID 3388 wrote to memory of 1836	3388	msedge.exe	104
PID 3388 wrote to memory of 2232	3388	msedge.exe	105
PID 3388 wrote to memory of 1836	3388	msedge.exe	104
PID 3388 wrote to memory of 2232	3388	msedge.exe	105
PID 3388 wrote to memory of 2232	3388	msedge.exe	105
PID 3388 wrote to memory of 2772	3388	msedge.exe	108
PID 3388 wrote to memory of 2772	3388	msedge.exe	108
PID 3388 wrote to memory of 4464	3388	msedge.exe	112
PID 3388 wrote to memory of 4464	3388	msedge.exe	112
PID 640 wrote to memory of 4784	640	chrome.exe	113
PID 640 wrote to memory of 776	640	chrome.exe	115
PID 640 wrote to memory of 776	640	chrome.exe	115
PID 640 wrote to memory of 900	640	chrome.exe	116
PID 3388 wrote to memory of 1304	3388	msedge.exe	117
PID 3388 wrote to memory of 3356	3388	msedge.exe	118
PID 3388 wrote to memory of 1304	3388	msedge.exe	117
PID 3388 wrote to memory of 3356	3388	msedge.exe	118
PID 640 wrote to memory of 5108	640	chrome.exe	119
PID 640 wrote to memory of 5108	640	chrome.exe	119
PID 640 wrote to memory of 5276	640	chrome.exe	121
PID 640 wrote to memory of 5276	640	chrome.exe	121
PID 640 wrote to memory of 5288	640	chrome.exe	122
PID 640 wrote to memory of 5288	640	chrome.exe	122
PID 640 wrote to memory of 5372	640	chrome.exe	123
PID 640 wrote to memory of 5372	640	chrome.exe	123
PID 640 wrote to memory of 5520	640	chrome.exe	124
PID 640 wrote to memory of 5520	640	chrome.exe	124
PID 3388 wrote to memory of 6132	3388	msedge.exe	129
PID 3388 wrote to memory of 6064	3388	msedge.exe	130
PID 3388 wrote to memory of 6064	3388	msedge.exe	130
PID 3388 wrote to memory of 6092	3388	msedge.exe	131
PID 3388 wrote to memory of 6092	3388	msedge.exe	131
PID 640 wrote to memory of 5680	640	chrome.exe	132
PID 3388 wrote to memory of 5952	3388	msedge.exe	133
PID 3388 wrote to memory of 5952	3388	msedge.exe	133
PID 3388 wrote to memory of 6028	3388	msedge.exe	134
PID 3388 wrote to memory of 6028	3388	msedge.exe	134
PID 3388 wrote to memory of 6096	3388	msedge.exe	136
PID 3388 wrote to memory of 6096	3388	msedge.exe	136
PID 640 wrote to memory of 4088	640	chrome.exe	138
PID 640 wrote to memory of 5960	640	chrome.exe	139
PID 640 wrote to memory of 5676	640	chrome.exe	140
PID 640 wrote to memory of 64	640	chrome.exe	141
PID 640 wrote to memory of 64	640	chrome.exe	141
PID 640 wrote to memory of 4316	640	chrome.exe	142
PID 640 wrote to memory of 2368	640	chrome.exe	145
PID 640 wrote to memory of 2368	640	chrome.exe	145
PID 640 wrote to memory of 4312	640	chrome.exe	146
PID 640 wrote to memory of 4312	640	chrome.exe	146

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\Informacion de impuesto de industria y comercio periodo 2025.msg"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/open?id=1Xt0bcIupRzvxJgtf0OdFoUcexnoWpRxI
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffffb2fc188,0x7ffffb2fc194,0x7ffffb2fc1a0
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,8334439719864843308,6833086316339247893,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4945906175945646913,17949165354387304781,262144 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,3062419691126145472,5665407682712727544,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,13092580070432103610,3891520777288088309,2097152 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,18053256702368913435,1329880061146466695,2097152 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4248333849384875336,9677784864058528326,2097152 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,11596445437756105990,4756982995219477915,2097152 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:2
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16947406679959571431,3873686986187409420,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,14228893687337075776,11452041792635818321,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,14580889526855322618,5706819038153460302,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,14444650954408623516,5545771954335440335,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12761591973232035462,5218086471724163292,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12761591973232035462,5218086471724163292,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,2369520917562452971,11288024644770961514,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3520548195782389076,12321678341201575048,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13651728889300562397,8211705293632612664,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,1317745727595734514,3056089793902764982,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,344796309999772875,4578858306985333051,524288 --field-trial-handle=2180,i,8628513079633067354,18051542606082083515,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
    3⤵
    PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffff911c728,0x7ffff911c734,0x7ffff911c740
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,3677309364232341947,1683905689661684118,262144 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,2009802272004066169,8627316576674634885,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,17200856133181745858,13710014080434510949,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,4933733874656247007,2308231565969478466,2097152 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,6555068260928268440,4725417826069302697,2097152 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,934753083931826937,6233683582419343485,2097152 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,10587431818889822428,7311915233443852357,2097152 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,5237965197844090181,2890614216269460538,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,6077496096103314075,17101494201995485751,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,9128372679245338346,9724417873474790157,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,17748168886230799037,15866145265987729336,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5832,i,1023522659717645784,1834135180331990154,2097152 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3452,i,4153930047711194240,6222610039625343948,262144 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3500,i,18439649065556265027,11657540328899942618,2097152 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1512 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3112,i,1696921287769924724,761322606643430895,2097152 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,7875708895798804994,7090088264358522699,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,12332277127398950472,13727430267688931249,524288 --field-trial-handle=2024,i,6363907892921308080,2280108456220772873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:3184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4292

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23359:118:7zEvent17514
1⤵
- Suspicious use of FindShellTrayWindow
PID:3452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\industria_comercio_dian_2025.bat" "
1⤵
- Executes a command shell one-liner
PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -exec bypass -F "C:\Temp\update.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Name /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5384
- - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
    "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5292
  - - C:\Windows\SysWOW64\iexpress.exe
      C:\Windows\Syswow64\iexpress.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3356
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp212C.tmp.bat""
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2508
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4576

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\industria_comercio_dian_2025.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:6108

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892
- C:\Windows\SysWOW64\iexpress.exe
  C:\Windows\Syswow64\iexpress.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f97e199cb85865386beea5b03dee0194566a026c934222b2b9649996ffa20253
MD5 0bf333cf978dfd610b49014dc70e8a54
SHA1 de8e67ff2e9e506855c4df99161da40059f76326
SHA512 9b8b4de37f41edd51384d873553c637f5bfceebc14d731b69542825cf100dba4adcac69d20744ae14d123524b2860b1404f401ce74bdb9ab090b1a7d35e60766
TLSH
T158E02B69C967AC3718F9571864654746F681135B26409C0F373D850D4FB473A418785C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 dd02b0e7ae40c40fe57b8bc9a02bc088cc9a2baa55751ce71d3233953e639d35
MD5 ee8d191a69f08194b33981c5387a0e61
SHA1 3bfa62c688e7f80cbbe61fff6705902d487cb5e2
SHA512 7cec62ed52d549fc25e396a0c74316e28e7d5b7a0ac2c0ec8833656b91c2ecc5756594534abf1d7b525b4872e5140534f81b9c82eb687a4f6f37c313e3586919
TLSH
T161F02BC6DAE6A501DB41003577D1384027F0566455048F5329BCCD7C6ED36A912F2EA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 4d534270e21101b6915e56402c83fca59bb3ec55bce3a67fe5b4294c45ac84d6
MD5 7a481f39194a47b7268ea937bdaaf453
SHA1 4f6212962132ebd4f36529a557353dbcfd7ad06f
SHA512 553e9bb3e0760167b3f027dd835c3aaf8cf12bb5cd59da9febcd16ea2818014cf518a5dc3a1a7ec68c2f8dd8727d2f099942390890d983d23412a6d03730eef1
TLSH
T191F068CADAF6A902D301003177D2384027F057A095008F5729B8CD7C6EE326912F2EA3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 dd85ff849e1a8b021a2ee44ed4e7850d19ab11091399fe85d2187f8768802db2
MD5 eb86b17afb16221ad1e7d3d03d6f86ca
SHA1 81ceab7d4f8273e720d6b5897568bcecbd608b04
SHA512 18fdf0cb51a2d7a148004fab7302cba0d62cdbc05efe0df0600d6455201c213f6d3420058531ff6601a9ca0edb0855464bad4289152d2e8d490c75463be208e9
SSDEEP 192:DHoUSpiI+3rWZwSzaOTNgnR+ocQJoW1yxeEAQpy9:DHoUSpiI+3rWZwSzaOTNgnR+ocQJoW13
TLSH
T1A202ADF3C3D8826DC94196F4AB126F1FCE2A0A18531C3C26C8D8AF5B97E2471E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 92568d58aad93e8a2406ff3b12ef6875bf859f5fcbcda2c89e5b3dc282fb5be2
MD5 0ac1f787a1020c5254eb0ef8e7a843a3
SHA1 fba48c7d8abead3e031c00d19ac5e452ac8af9b8
SHA512 d24a4c5d817805c4269c0eff11e2bbe7577e606a0c28031b9810172c8d20e9ba9ca2cdfbaa9da27ad89958fe062152357c5c50956d8d929945fefd96ccf17f88
SSDEEP 192:D0uwQnvtVUOZyTWjTHJaOTEdnRuqsJoELWZeHZsmRfjhJv9:D0uwQnvtVUOZyTWjTHJaOTEdnRuqsJo2
TLSH
T1B7F19DF793E5C62DC90096F4D712AF1FCE291628431C3876C8D4AE6B93E2572E21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 1478b24e7d71a08aa29ca22300b193157d89626dec486af46d65d96c394479f0
MD5 280cfcfda9ba4c5efa2674b8daa2a997
SHA1 72b6cbb01ccbca0bfdc2408f73c85663d906337f
SHA512 3a1a4b96b59aca178c3c5ba3d889d1ca1eb1917990c201bbfbd9413820935a981919114f2ce339f9d23f976813a8f44ca6b770e6fee83852c49788358f5a55a8
SSDEEP 192:DHoUSpiI+3rWZwSPpaJaOTNgnR+oEJoMXeEAQ+opcDlfjhN9:DHoUSpiI+3rWZwSPpaJaOTNgnR+oEJoJ
TLSH
T1A322BDF3C3D8862DC94156F49B126F1FCE2A0A18532C3C26C8E8AF5B97E2471E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 7e78b70ff931d4803f67788343c83f376cf5f1a370a6ff3728fe55c561c6978e
MD5 c17187a4c6e5e008358e8987999bd9ba
SHA1 c684293f7e5364e434f51224e798f855123a5f29
SHA512 4a9c26766d652508218979cf5a314c23621f7ae9896e7440b8230b2467e418c950d0c8bdda6350eeecbc8cb29cc53b6e14e3eaf83f1a61c4cdd674df13401c0f
SSDEEP 192:D0uwQnvtVUOZTWjTHxmaOTEdnRuqsJoELWZeHZsmRfjhn+9:D0uwQnvtVUOZTWjTHxmaOTEdnRuqsJol
TLSH
T110E19CF793E5862DC91096F4DB12AF1FCE291628031C387688D46E6B93E2572E21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 7baf02fbd8a4c1f8f2dbee68b0d639c246d0ebe93939fee6d77afd004e92b53e
MD5 8800b03d31824c54f5f6ff2cb87deca1
SHA1 f2f780b050b654945851e6cf706f9df24be42992
SHA512 fc18318bbf71de13d93c93ff8e01bb42cdee65726fd3716cc2c71de1707f0675babad476daf86b8ec335db916603b567de0f929b1b49fd16be3d84d0e609af5b
SSDEEP 192:DHoUSpiI+3rWZwSPpCaOTNgnR+oEJoMXeEAQ+xPlupPR:DHoUSpiI+3rWZwSPpCaOTNgnR+oEJoM1
TLSH
T17012ADF7C3D8862DC94156F49B126F1FCE2A0A18532C3C26C8D8AF5B97E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 37fabd5e68af312eb6230e30a6b76077c1849053a7829c80ce26146620308559
MD5 96250bf7a29c6c8fc31b046df8125ff5
SHA1 f0892f99b232d138c3adef2da6eb192589397080
SHA512 34d28c7e4184fd4e17a29a188b77b74c49acdfcbb737dd6a91d8ffc68d537a8f1bbf88b4cda2cb819319a919e21d0bf08a435a47bcfdc0eab161097d0aa297fa
TLSH
T11E51A0F3D3E4867D891196F49A116E1FCD2D0A24121C3C62C9D8AE5B47E28B2D21039E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1a299bcfa758d7d322ac5fd65083caf3148ce701a1f4e6c1de083461f54dd02a
MD5 566d610faa8e7492195e1d1827220ef8
SHA1 feddb2e78d13808a9bdcbadfa41898e1060493d3
SHA512 68b7555bb8be6eee57fd6ecbc7aa7b348f49dc0e732cd34852c5ca3a3af116966cc184e458436f5fb9d06b13412a45e123557dbfd946c3f12b123737ef95efaf
TLSH
T1D321796792BE7DB7206E4AA71D067C0926BBAC35429158E4DB5F837CB0A15F30F1206B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 92c8eae7f1d740cae6a05bce7db61b4464bc6e6949a0051b5fd45babb7c23213
MD5 0e5507b034e81cd60069f14fb2a81f8e
SHA1 a6901f1f3ae419de83b90cfb96fcc58017d6b74c
SHA512 04d65b235103d3bbc4ec46b38af7455128fb21ad8f56fe24dadef26214a6aa8b6eb22898aea2b65cf9c078f3e7f34e83ce07215fd3ab7e1a71e8a0034c0cbcd4
SSDEEP 192:ORqqwIplVTUhv7MF+I/PRpr9IdRIx9HHsb+WNn/VyBxe1epUHskwMa7VyIsnAUge:ORqqwMAgowXS01wtge13Msa9e
TLSH
T1BB52B36BED116A7B9CD7C229F912BB57D7F6102121D41E88EAFC8E2C19E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 092818c05c7d87cc202eaf8b553d87f6f9b7f837b08163b71941aedb4619bfac
MD5 e903103da4767450d5daf94288e8718a
SHA1 e89a46d2687c51e81d62b1a9e5a0bf31ebb4199e
SHA512 2da5003b8d9a2b7f7b674894007916ab19e72faff7bccedacd7a8ca788955d9f2c3fa49071a61996fd81408c7c5d3d739003e23dc933b7ff20eedb79539f4cff
SSDEEP 192:ORqqOIplPTFPAhv7MF+hAPRp2S9HHsb+WNn47k10OrepUHskwMa1VyIsnAUgtaJ:ORqqOM54go8X91wx0q3Msaj8
TLSH
T18842F96EED15697B5CD7C219FD16BB53D7F6102121C42E88EAFC8A2C09E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0683e9cdb80112624a0ce43688aff51bec78dac849427e3ada8282d4faf8ff93
MD5 8f0231e70b2625feeef9f071c2a8b5e3
SHA1 66cf6d0aec0c4bda2708feb8bdc7776b24b21cbf
SHA512 5430dc7463d4faa3de0bb301e356e4ea0f6236437c8abdcd50f46c3cbe2b943f9f5257afe903652b5560f61207cde345369dcf7b7b352fb6ccd0f899697488ab
SSDEEP 192:ORqqw4plVTUhv7MF+I/PRpr9IdRIx9HHsb+WNn/VyBxe1epUHskwMa7VyIsnAUge:ORqqw8AgowXS01wtge13Msa9e
TLSH
T14652B46BED106A7B9CD7C229F912BB57D7F6102121D41E88EAFC8E2C19E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7a95aeb96cd667dbb82fa83bf5e66340faa09aaf3e716336cbd5aabc27209bc5
MD5 8931306ab40a73125a6b24afd743100f
SHA1 26b52f5f4a208fcd50dffec5ee653b96c82b87cf
SHA512 7aecf5d8e9c01a42f3f253e68bbdcbe64262a507ff6d419a835fb240ad081384bde8ad5be1056a481f3826fe86f53f12967472265de762bfbd8514081488be23
SSDEEP 192:ORqqOIplVTFPAhv7MF+IAPRp2S9HHsb+WNn47k10OdepUHskwMaJVyIsnAUgraJ:ORqqOM54goJX91wx0a3Msave
TLSH
T1CD42D76EED15697BACD7C219FD12BB53D7F6102121C41E88EAFC8A2C15E76CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5f11ffd135240f3e9818279d4d0a2fec965cbb0196f0a84d031234e9d4881c1d
MD5 2b04d366a63f1aed3788fac68ea93e2a
SHA1 ddfbdedf3251fb50c1965e8f11f368cd951ed825
SHA512 c49e7fcc3cc09117c29df3f6fa25bb4ea3462e12d093d83ea018dbd84327a8d12295ac4a7ab384cb3fe74063c6f8280704ac0d2c6a27f25ce8cefae08250310b
SSDEEP 192:ORqqOIplPTFPAhv7MF+IAPRp2S9HHsb+WNn47k10OrepUHskwMa1VyIsnAUgtaJ:ORqqOM54goJX91wx0q3Msaj8
TLSH
T18042F96EED15697B5CD7C219FD16BB53D7F6102121C42E88EAFC8A2C09E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6c2834f99055789ccdd9be36853171c754ed8c044adb7f532ca7ec713eb542a5
MD5 65395dfa7b8b61d09c32b4d5f691df3f
SHA1 8ba635401ab9677750a6c35f0cb63ab197454ca8
SHA512 5b7349a92b7df67ca5058578deacbc0734d2abd55fb0e87f54a4279fd794df47f3a096c42e76ff7e5e3f6a052a15560d803508106857a2ac4f49c8dfa4912d61
TLSH
T14FB01250C003A502C14602B01542A4C8B1949F10970E370553E4AAA2CC261A18014051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596b24.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596b24.TMP
Size 96B
SHA256 4ccd50ea6b8daf6dfdb767e75b0cda3d7b43e85a24e748a60b4752ad418d8e24
MD5 e113ce931c6baf6a28993a8862acc097
SHA1 768767a53bd6f3db2f07e23e7ccd6e55d9b53b7b
SHA512 dbc897657c16412fe4a4b527f9408ab5bb68e157316bfcd02a8c75b93c5b6c6326d9c37c1fdd18b8bd9c1f001878f7ca9975d1feeb422bb39f33c44f27046c80
TLSH
T106B00295E1036313C54643B0369595DC7260DF29DB431316B7FC6A77DC76A714525160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 2ec21b0153d74cd9d6df1a9f819e4e8e1cfdbb19046f7256e415b956c84d66a2
MD5 e186794ef6ce42ce9aac556d060a564a
SHA1 ef0b7f1e13eccb46aac1d2a2f33b47800b21fcab
SHA512 2ebddc071a13d35bae95a3d20efe17f2e1199489ab22d7817aa6df46da1179dce2abe508f8da96508427e773b6276957b3be8bf4903af73df125ec7f87ccc246
SSDEEP 6144:3QhQ5tTbRIn7e2f7vwO61m7Rkm1tYpBeh2BAoH:3++38eiC89oBGcAoH
TLSH
T1383422376DA0E93B19FB9F6EA44E1B2F1EF35B82D910C68498D43E05D199B804D0BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 2e61c7b93d6a83d2d06f1309918148fe240b1c121102dc05cb33064f70df81c9
MD5 54dc4692787b14e600a840a7d447ffa1
SHA1 d28cb11efd5367d5557ad1afd982f93e9c584b3a
SHA512 c9cf34043217d1c18c3f8176130d48908d5f1573930044d8265af3fecb167d440bf21318df84b6b32f7581d64f42a8eb78d029133392b84f96650717bb4854ef
SSDEEP 6144:3tQ5tTbRIn7e2f7vwO61m7Rkm1tYpBeh2BAoH:3t+38eiC89oBGcAoH
TLSH
T15D3412176DA0E93B15BB9F6EB88F0F2F1EF35682E910C6D188D06B059599BC0194AE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 61bb96df051712fa43390b82e45272ae099441e26e3a641a0c2968d3f56632fc
MD5 5ec0930e48321bc08e0b9f45891b7563
SHA1 cd4da1d509c945c763d9f890e9974c96301c1cdc
SHA512 6e1041850feccd54ac37bf4f75aa64a0a3eac120924f9c4c5c2095302ec9412b7ede96e0a5280605415d7adaa0e46c53ba22b7180ccd29d86861376c7a6f690d
SSDEEP 6144:0tQ5tTbRIn7e2f7vwO61m7Rkm1tYpBeh2BAoH:0t+38eiC89oBGcAoH
TLSH
T13D3412176DA0E93B15BB9F6EB88F0F2F1EF35682E910C6D188D06B059599BC0194BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 ce33bac53b6efc15f9c8493c6f1a4e1760544f08085519b07a927ca0fe990909
MD5 c74ec63c63037c4dfadef2b98f868787
SHA1 a34b8039fbf0f09d8b5342e70e1aa439c73b23c5
SHA512 7f3dc74ad51ed267a75c531a83e95112149c772e2ee780783713e6182da2a501e27540effecca0c03dac1d80be2ae3838d8a1d539fbeaa2d81721c0aa4d9b20c
SSDEEP 6144:3fhQ5tTbRIn7e2f7vwO61m7Rkm1tYpBeh2BAoH:3p+38eiC89oBGcAoH
TLSH
T11A3422376DA0E93B19FB9F6EA44E1B2F1EF35B82D910C68498D43E05D199B805D0BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 925b46d4a53787572151859cd415f5327399774a381e4b05141df01cdf24706a
MD5 fc5561f17e5f9f88b2ea469a62e7c2a4
SHA1 e1a318cd058132fe9989549213af941aa4c6fbd5
SHA512 e600e974142984e870f3b3eeafe171c3fbdd822c24a7e6f3e9ea41262d3402c5b2f97eb585f907cf81464f0e123044c73e12a53f174126f41c5b7b1029c05bb2
SSDEEP 3072:/gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Lm7Rkm1tYpBeh2BAoM
TLSH
T1E6C312275E75E93758B9BB0EB08E0B1F1EF14AA6D830DA92C8D85B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 f36c169df25bca0770644510f5c85b9739435b2afee6dfb076cc5265a26e12c2
MD5 c92793bc67726d73562f34a85ff51486
SHA1 e3cdc899029589a39fc80cecba58b7e600fafd32
SHA512 f74d223b5b9e279f0cddfed90189c6c396e8018a2fd58841c72e00c786d1779f3536b8ee0d37c5c110df7efa3d605a8c091e1429a9769ff3db8561361875b8a7
SSDEEP 6144:HfhQ5tTbRIn7e2f7vwO61m7Rkm1tYpBeh2BAoH:Hp+38eiC89oBGcAoH
TLSH
T1263422376D90E93B19FB9F6EA44E1B2F1EF35B82D910C68498D43E05D199B804D0BE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iexpress.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\iexpress.exe.log
Size 517B
SHA256 494fcff7f11e2d7ea9abfbf91d6dea2595388ab4c45269e5fd74c82796d0a76a
MD5 3334ecde6536c93e216decce323cbe3e
SHA1 277f9a4e3a14c5dbe6b92fabac8b2050cab3629b
SHA512 2830773d60aa9fe73c7e0a28502e198d931422b4a1df9a0b844d3952bb0aed7aa2b5da39e1adf145c9e6c2f75a33560da23c9b2b774fb38718bde066eafcad9d
TLSH
T1A5F097303322E0D889522F521C2C7A9903EF075AA260EE2C3998126ED826117AB312E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7909299f4c51e75a0001702e41f0f72b946a7c66746ea9af12abe4d9dea7bd88
MD5 6a0ecaccbc79dc82cd6402d57dc4a083
SHA1 4b72080c1db98ffc51edc408f9ae5017eef9f8fe
SHA512 672d1e15a11ee7e9ca512af78112f237077d6b2be740fce793345b14d653e5800494f692a5d1eec58614891295263550f467f3f9cd788c551840b5d284b07d78
TLSH
T14CD09720FD08F8E1E1232079021003003E8C08A220538145E020082CCCB8482C2E0AA7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1945d0ec44cb4a1eac3cbcecf8fe6179ee3c5143289ae28cf250d3c0864456da
MD5 200d678c2e6ba0e9ad244253f6997dc1
SHA1 7ed6c7e496dceaea0ba01fa89405748998179556
SHA512 cd5d6a0dce8e9346249cefadfa6ef54639b7a3f5dccc83d7b7fcf1aa94113e53c7dd319691c4f814c6afe54457044ce6c4c17944bb77d42f263546864212f91e
TLSH
T14A81E772159304B2EF40C633A8E9614D323381FBF8178D530494887F290639DE79AA9F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596930.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596930.TMP
Size 3KB
SHA256 2ccb19cea4341aee8b1e18df79da30a82573a838fcd10ddbabbb7e12ed4f11ee
MD5 04785201edbd17d66ff6cfc74d7e2ae8
SHA1 a3a659b4cf9771d5a4131028293c1b179940cfc3
SHA512 8b77b8cef18c64af864eac15f722f63105b86e03f2acdf2e93a55cb51035d1703a92acad9c456bf80b36877d7b6020dc16ccec08b897c122bf94b7d15db591d0
TLSH
T18971C436259305B4EF50CA3398E9824D723785FBF90B9E535494087F290636CE75689F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 19fe6e08db6bd10c1fe06f0c3bfaa759b2a8c9d7ef2e9cca4ce7d4522d693f59
MD5 90754debb4b20a181d264b82a7f3ff79
SHA1 932b23dc4d65cd8e9637cf08f59f496b4f81f06d
SHA512 5fc031e408122692b217aa740638ec94b5d0ce1485e43e365c4fdb3914eaffa0b4b52901fe51aa128080819850d4ea8f429c9eb806b9e180ad311b38ee3b82eb
SSDEEP 192:Dh7/iaHpfNLTly2m7v8EKH7q54F2cIbdAhLsjKPjR:Dh7/iaHpfNLTly2m7v8EKbq54F2cIbdW
TLSH
T19502ADF7C3D8822DC94156F49716AF1FCE2E0A24431D3C26C8E8AF5BA7E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 45aea3cc7013591757cfb70481e42507e3c9468d3c3f6faa8441648592f11fba
MD5 49d8f56710c9c7dff349bceb9ea9d101
SHA1 1158642579324a15bf6b922e6458d975d8e7c746
SHA512 1789fb0c798a2b46c46c2196cff378d534be0e1f638471aa40f81e66bd685347114ebacb4a79cd91a602b11e0fdd9793ac8a9db9bdbe3e60af0bb0c15fb8dd8c
SSDEEP 192:sxZyRVZG/fJshIkV8IdpT0+HW6+WNyOVS+/YvP9uGPQ9ZIg4J:sxZyZG/fJshZzHbN/MY3c
TLSH
T1AE32C852AE24A9378CC7E219BA25BF53E6FA503291D51E48AAFCC91C04E76DD130781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a53bb92641b931575c93ad8c6305d666b6180a9757f7328028a76b27f3663038
MD5 c9e48397c4e62bad0e27d3d5ef540a5c
SHA1 0039b2f7f0894c2caaefd4065edc3a8fd2ba0346
SHA512 1448bc2741ca0f84df67d9ba6ccab2444acbaec19b907835b476d2f8432cafccfc7c4fc4c036e3c25009d827061949941ff2a4aed85fb1656d45b1111012d5a5
SSDEEP 192:sxZyRVZG/fJswIkV8IdpT0+HW6+WNyOVS+/YvP9uGPQ9ZIg5nJ:sxZyZG/fJswZzHbN/MY33
TLSH
T1BE32D952AE34A9378CC7E219BA15BF53E6FA503191D51E48AAFCCA1C04E76DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9002ed6c15c3bcceda94cf69535a00c6486ddc6c3274a8cfe66551fa3691329f
MD5 3df7cd5fd86b9cfe30a1ef75c040849d
SHA1 0e145e88de0a1462b5bbc7f4331ccb33cfc2c079
SHA512 786c453b30cb3399185f5a47d9c5841dea6462c7d62150a4dd1a046ac440d1996499da201a568a3660046b8cc27dd529e94b89778711c2c62d7a6d2e39fe7093
SSDEEP 192:sxZyR4ZG/fJsiWpV4IkV8IdpT0+HW6+WNujOVS+/YP79JGlrC9ZIgbnJ:sxZyOG/fJsiWv4ZzHbj/VlO3l
TLSH
T1A342C712AE34A97B8CC7D21DFA25BF13E6F9503291D15E48AAFC891C04E76DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 80f32b699776d2728585a576be268ac73296e79c91fba8496cce4c29fdec5900
MD5 c4fba8dfa88917675aa85f5e8a425f26
SHA1 7246a4a50272ec58d55f0a05b840499269b58e03
SHA512 e425779336b36949a21d874d10dfa05c3b5b0d2566ffdac69d76f4d383748bcba72dfc9417a1095ad2122ff97059c3f7f52fc16ed46349b840ddc0dae6754107
SSDEEP 768:0/ee3987pLuLbNxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVKMcLly0pbrrox:0/ee39gEbNxWvhffnu1jaEKMcL88bYx
TLSH
T1C1E2FB3B780CCB7E4FC04A9DDD1A7F9B6EA802CB5698C94487F9985C02C77EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 32e8cbcaf62871f5a0951498e7df27e02b97892bacfda4dbae1cf20a2cc463b7
MD5 b30a5e1db5778d9af751c54485b2177a
SHA1 742f5501ddebbdbacbbe8d5667476bbbe0349531
SHA512 c5624080f909ae0ed10101f1e99977460f8fbfec896529f2953983c8f58630422f09bbe56a7f0a67d6e6197038238de7434f4c5a2d94ed092cce3b9f20100618
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1ED:KYHIhKggkXypqI/Kva47ylVIhKeEUdz
TLSH
T12691FE07757A02123CBD2458B29396378E4235A3745CF4AFBFB904A64E26E110EFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b0e15666e2827a98fcf08ec83c29adb03dc59aa1052cb27e00ac8c4d20fa278f
MD5 5537f8b7cf9ee663c33f0532d7b0733a
SHA1 8a957065cf12f02813c16b07a2af58918d6468fc
SHA512 bddd6fed6d3246a98e700fbe1a8a1e56e453f487f73b863deed9bb5b9b5eccfe1912a26fcf0e5f15c2b4ec41a5b9f02d7b945286f74608f8f56965d4eefb5181
SSDEEP 384:nRVZcI0sNuuQMT7T+1F55+YdUwSvAStuIdG/L9dANz:Rt01MTe3YqUw7S6L9dANz
TLSH
T121923BF1D8A45DF794E2E5C1A485F6132EB8813BD5885A4CA2FC7B3D309F5B81327826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1eabe9a15bcd1516e94bfc8667029371b3637a742d5df932a37899f1b7897f45
MD5 e05f2b234a449e2179302405715871aa
SHA1 6531ff9a430d8ef04abeec7c57471d0389b0d7a1
SHA512 313c4745b2ce0806dcecf5ec0c183770d28c7c8854f1f518c87eea5e289ec733e27f2b555c154566f8163da592e025f73273639ed46e0c3dd0dc45857bba8ef7
SSDEEP 192:lONz6vMtPQmiUy56ThToqC5Ta7847cldU/u:lONz6UtR3T+5+7aU/u
TLSH
T103020875AC686C7BEEA3AE45F48E27271FF4516FA5905B40EAE82F1D00D724C2307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cb94af31786efc83239d4eed924be7aa1d538778d3778f2f0530a1f35f812df3
MD5 31afbb81f818f3bcb68d985abd026563
SHA1 a746c611a86325aac605862c42173054acb28ce0
SHA512 d4be6d0b9de0244ed1975c660daa52a9b664d4dd8d421c612b6806838b35842630b8cc2882cc9c914ceb6984fb2997b2c25ab5ae9e4362b4d77c4e24df80c0e8
SSDEEP 192:uuRJ0+xasuheOwQxMHsNHYJQkYMckmM7j3CQmiU1R5a4MToqC5TagHFd3ENp8z1X:nRAZcI0sNHuQMT7T+tF55+YdUNO1Nz
TLSH
T125725BB15CB89D3798E7F145F48A27135EF8A07BA5C48F44E6ED5F2E00C7298171B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 81758d62a48b7e62ffd1e7b7cfeaf8ca32d44d6533f09a1ff0c16e43429a75a5
MD5 f43fe7a52905e83276d9f240078a74d9
SHA1 291f71a0cbc1b980e8bb242ae2b637189dd55eb7
SHA512 3eb2229092c14d6962eb9f2de1e82951bc730589d28cdc8c33c6b3000ae44fb1a07b80fbaabb78ccfcd350bd71f65e4b9fcdabc0d2c5df13c1369534aa576a41
SSDEEP 192:TONy6vMVPQmiUyW63hToqC5TagHFd3EG80IzqiXXU/u:TONy6UVRo3+5+YdUf1U/u
TLSH
T15112F9B1A869DC2B99A7F505F4CE27935EB461BBA8809F40F6D82F1D00D725C270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 6c814fc11b13832a2616e996276a61544570a19dfad5cd57b46fce7dab57c3b2
MD5 0509051b9dd9eb04ddd9fde834b98c53
SHA1 54d97f17613e71be36ec1cf701a885f632a7b48c
SHA512 af041dfdf7de4bee24d186063cd2cba84b728849bf1387a06fa7cbc5657755f6c3896444599bcf5f2c0f8b51758d0d968836c0c655d69fe636a5a00a41f5d36c
TLSH
T169416D5CA6E91008B3B7AF569BF2A4AD483B7D772E07D04D00510E4F4A23B00DCA1B33
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 71045758295201083aa3ba23494af600ecd5c63733db1efb6aa0de6aa1dcdde9
MD5 1ac8b24fa3f429f1a5177eb6c5782efc
SHA1 19b16e3a867f9fbb9ff070d5b5ce5010c0913856
SHA512 392d3d8155183a3ed0208f6c064f43c8c6d04d75109a16a9ee597af26798a620ef0e4fa4081e33a098177f171e1c0dddcecdeffb5c82d04a8b2e1e95c32a656f
TLSH
T1395129596AEA1158B3736F9A9FF668AE583FB8772E07D05D10110E4E4623A40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9d99f1f42daf360662f22f637276a90950a5514e31c5fbb64e83cf02e91279ed
MD5 320c873997eaf5399912f9993b777f87
SHA1 513b903325dfbbb7fee125b7e699b2a85b571614
SHA512 3f2d98e04ca0cd7cf2bc8d541f552aa31d62bcf506cab7aa3d5d2f597bb57bfd6adb6869a59a1a329dc1261dec75214900eabf8d8d9f91a10a444c8a107db029
TLSH
T100411858A6FA1148B3B7AF5A9FF6A96D447FBC362E06905D00110D4E0663B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

1a02d1ac-3292-465b-99ad-0409c1eac15d.tmp

Path C:\Users\Admin\AppData\Local\Temp\1a02d1ac-3292-465b-99ad-0409c1eac15d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e180721-1bd7-4464-a691-a1f42f612b50.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e180721-1bd7-4464-a691-a1f42f612b50.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_i0vekpqr.003.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0vekpqr.003.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3b43f3ce-8398-4f7e-8d9f-88ff97fc800d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_1870868930\3b43f3ce-8398-4f7e-8d9f-88ff97fc800d.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_613845745\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp212C.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp212C.tmp.bat
Size 146B
SHA256 bd1b0ae6409b61c8e2b31ae51c3e2db3037cc44eaeaccc239c1c08495ed20a5c
MD5 31dfcab5b3d08f9bffafb4ae9ea60026
SHA1 76d5c1868f4aadb7ef5b2570bbf04376005166f7
SHA512 3a73bc29b4bcc121ba4812ca6bdff68368c5423f8b5ea6ab83e77273dbd4a537cc0bddcf19a6e4d986b21541c98d61f1c16964b05905a527c6b82dd32b192b29
TLSH
T185C02B4038C5B6C13581380320BA8049C213AC0F2D50BB74735C40247C008A8DD7438C
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 78KB
SHA256 80a8dd1254bbbe03492be6a358b564ca0a6a2ce3531ae75417c849b02d57f971
MD5 495a72a1e6b324e2d0622c1ddd1ccb57
SHA1 8666c7f4952ec5fd84da7db2fc1c01103658f29d
SHA512 1e1ca4d53fe681e64c4158809fa098eae9aad4f0df61ddbf85d01217663d0388f1335d52c8855e5c3e5cc9b337abd684c49cc05013bd54764c78c84e582ddaa5
SSDEEP 1536:7car6AlazcY3s/kQB4aXwv71HbBPXEsZF/PUhEi+Li76MCfpy+eob6x+UBW:7c8sIFky4YU7hNX7ZlUhm+8xy+dbDUc
TLSH
T1D173E180CD6254FC73B1CC0FC36A09BF09780B6D0A33C89A9FA7591E9776B59676960C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 3KB
SHA256 36ac32fd7fcfa2de29841a5d652aaf55bacc0a7541d3361f45cbdde44d24b3d6
MD5 48f5ca49903d4494c9345f27373fdcd1
SHA1 0f7b1ccdf9dd55c4e45c514ea94049622a150e7c
SHA512 e999aa4a883ce8872f6060f5d0b1bf9f26ed56e16c3d40bafa4fad30e1c2edb26cf62d3737f4b750bfe96eba0b3a3aca5080d614fc0ab43fb17eff3579af76c4
TLSH
T13951E0C47C0FE5402CA8211A9D29CE6BF79EADAF053D01303E99C2959FAC7BCE048748
MD5 SHA1 SHA512 TLSH

Submit Download

industria_comercio_dian_2025.bat

Path C:\Users\Admin\Downloads\industria_comercio_dian_2025.bat
Size 2.4MB
SHA256 eeb4031a1300fba58e6d9c69ad2b8a1478b83b1957f2b48b3ea91665e9e862fb
MD5 f2a71b5c8f46b6dccc5b00bcaddebc6b
SHA1 1581adb3f369559ca3e1863edd00e426a9608795
SHA512 0fcc50b718d62d7b871c494323bbca100cfddd8a2f02f0681f53c3a5d1669342ca01725a43156b8f4e6f0c2a159b03695026ec3adae1693e5742783da6e79d98
SSDEEP 24576:JtvB440fdIYnqCrmEVWdn2jxZzebX9IhhDFfi/YuZcerQcTLVFg7pzUddE8WlXVF:uZrEdnxMh7/ZH
TLSH
T14BC59E0B4CE62A3DA7D4320D50BEE64F2E9015B7AECC146FDA2529697DB794DC00F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

industria_comercio_dian_2025.zip.crdownload

Path C:\Users\Admin\Downloads\industria_comercio_dian_2025.zip.crdownload
Size 1.2MB
SHA256 f5773259eb436a68aeea4fabe6fdb9a846019c0f944259bdbce926c65b3363da
MD5 57f3fdb10f00dbf213ca5f0a6d04126f
SHA1 d7944e2936f4064e22c681694a873e1db5195323
SHA512 e06e8a2d4fcd3228357d48b6d2713ebcfe6608d46926800d54c97d0d21d837f543862a31b828a5b468bf53847dffac92b5e2d00b42a5d382533bbc7abe163dd9
SSDEEP 24576:saPpY5kaVJf1Zah8Bu05v7IFysfiAbi422ZuiFRWVgZHuKwN5gA8W3a:sspYh1ZahIT5cUsaAb522BRWgvw7gHWq
TLSH
T1DC4533936045FCF85A1EA8BF062C7FE973D1C30DF35598242EB984549D23FD6E8846A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-13-0x00007FF7DFE10000-0x00007FF7DFE20000-memory.dmp

Download

memory/60-0-0x00007FF7E1ED0000-0x00007FF7E1EE0000-memory.dmp

Download

memory/60-6-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/60-2-0x00007FF7E1ED0000-0x00007FF7E1EE0000-memory.dmp

Download

memory/60-12-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/60-11-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/60-14-0x00007FF7DFE10000-0x00007FF7DFE20000-memory.dmp

Download

memory/60-39-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/60-4-0x00007FF7E1ED0000-0x00007FF7E1EE0000-memory.dmp

Download

memory/60-5-0x00007FF7E1ED0000-0x00007FF7E1EE0000-memory.dmp

Download

memory/60-3-0x00007FF821EED000-0x00007FF821EEE000-memory.dmp

Download

memory/60-1-0x00007FF7E1ED0000-0x00007FF7E1EE0000-memory.dmp

Download

memory/60-9-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/60-7-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/60-10-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/60-8-0x00007FF821E50000-0x00007FF822045000-memory.dmp

Download

memory/1856-1014-0x0000000002800000-0x0000000002812000-memory.dmp

Download

memory/3356-1029-0x00000000065E0000-0x0000000006644000-memory.dmp

Download

memory/3356-1030-0x0000000006640000-0x000000000665E000-memory.dmp

Download

memory/3356-1028-0x0000000006660000-0x00000000066D6000-memory.dmp

Download

memory/3356-1019-0x0000000005FB0000-0x0000000006554000-memory.dmp

Download

memory/3356-1018-0x0000000005960000-0x00000000059FC000-memory.dmp

Download

memory/3356-1015-0x0000000002B90000-0x0000000002BF6000-memory.dmp

Download

memory/3356-1011-0x0000000002AC0000-0x0000000002AD2000-memory.dmp

Download

memory/3356-1010-0x00000000003C0000-0x00000000003D4000-memory.dmp

Download

memory/4188-985-0x0000017ED3320000-0x0000017ED3342000-memory.dmp

Download