bandook | hxxps://drive[.]google[.]com/file/d/1u-UbTZbsdjctAnektHxM8aA9MryVPA58/view?usp=drive_web

Resubmissions

08-11-2023 14:52

231108-r8ytzadf89 10

08-11-2023 14:00

231108-rayfjsdd34 10

Analysis

max time kernel
1200s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2023 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1u-UbTZbsdjctAnektHxM8aA9MryVPA58/view?usp=drive_web

Score

10^/10

bandook persistence rat trojan upx

Malware Config

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1744-383-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/1744-384-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/1744-385-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/1744-386-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/1744-388-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/1744-390-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/3392-399-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/1744-411-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/3792-434-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook
behavioral1/memory/1080-448-0x0000000013140000-0x0000000015265000-memory.dmp	family_bandook

Executes dropped EXE 4 IoCs

Processes:

Facturacion_07762.exeFacturacion_07762.exeFacturacion_07762.exeFacturacion_07762.exe

pid process

3308 Facturacion_07762.exe
948 Facturacion_07762.exe
472 Facturacion_07762.exe
1716 Facturacion_07762.exe

pid	process
3308	Facturacion_07762.exe
948	Facturacion_07762.exe
472	Facturacion_07762.exe
1716	Facturacion_07762.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1744-370-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-371-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-383-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-384-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-385-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-386-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-388-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-390-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/3392-399-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1744-411-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/3792-434-0x0000000013140000-0x0000000015265000-memory.dmp	upx
behavioral1/memory/1080-448-0x0000000013140000-0x0000000015265000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msinfo32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LK = "C:\\Users\\Admin\\AppData\\Roaming\\LK\\LK.exe"	msinfo32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

Facturacion_07762.exe

description pid process target process

PID 472 set thread context of 1080 472 Facturacion_07762.exe msinfo32.exe

description	pid	process	target process
PID 472 set thread context of 1080	472	Facturacion_07762.exe	msinfo32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000004f4a363cc405da01f86740c4cc05da01ef1c52044d12da0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsinfo32.exemsedge.exemsedge.exe

pid	process
2328	msedge.exe
2328	msedge.exe
4700	msedge.exe
4700	msedge.exe
4384	identity_helper.exe
4384	identity_helper.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
4212	msedge.exe
4212	msedge.exe
1744	msinfo32.exe
1744	msinfo32.exe
1116	msedge.exe
1116	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

Processes:

msedge.exe

pid	process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description pid process

Token: SeRestorePrivilege 472 7zG.exe
Token: 35 472 7zG.exe
Token: SeSecurityPrivilege 472 7zG.exe
Token: SeSecurityPrivilege 472 7zG.exe

description	pid	process
Token: SeRestorePrivilege	472	7zG.exe
Token: 35	472	7zG.exe
Token: SeSecurityPrivilege	472	7zG.exe
Token: SeSecurityPrivilege	472	7zG.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe7zG.exe

pid	process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
472	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

msedge.exemsedge.exe

pid process

1116 msedge.exe
1424 msedge.exe

pid	process
1116	msedge.exe
1424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4700 wrote to memory of 2316	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2316	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 952	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2328	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2328	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe
PID 4700 wrote to memory of 2936	4700	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1u-UbTZbsdjctAnektHxM8aA9MryVPA58/view?usp=drive_web
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff882ba46f8,0x7ff882ba4708,0x7ff882ba4718
2⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
2⤵
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2432 /prefetch:8
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
2⤵
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
2⤵
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
2⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
2⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
2⤵
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
2⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6400 /prefetch:8
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
2⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
2⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
2⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
2⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
2⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
2⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
2⤵
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
2⤵
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2136,3491805428574146087,10104159615773608370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7288 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2192

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12847:94:7zEvent21402
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:472

C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
"C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe"
1⤵
- Executes dropped EXE
PID:3308

C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe nnchwwghwgehwgewyeywyeywyye
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:472

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
3⤵
- Adds Run key to start application
PID:1080

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744

C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
"C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe"
1⤵
- Executes dropped EXE
PID:948

C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe nnchwwghwgehwgewyeywyeywyye
2⤵
- Executes dropped EXE
PID:1716

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
3⤵
PID:3792

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
PID:3392

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\43e03c03-9821-4ef2-814c-7d41800eed7b.tmp
Filesize
10KB

MD5
06546f3e2c9c686383ac1e5f2b1a1b76

SHA1
a6e1131a082da017143c09e32444ed0d20e4e81c

SHA256
8ef82baf88ff0169e439c19c5688a0ff3b8a787f3df508b468108c8a8ce0ce17

SHA512
e870a7d0790ada5ffedcac25ec38b7bad6367cd0da1e7f773dccc1980c1746693ed1513181e6632056e8e017ade00a712f81948846c1045123cf4f9285ffd3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
75c0058882e09ea197a7bc4404ec4041

SHA1
2f5a83f17d097d47b9e205b3ad791aee92c824b3

SHA256
5ffcb7ba3c495bb909956e164cbb748937f9a64904bb87ed40d6516267492a88

SHA512
a7476cc8b243e952676fd48583f407297f158f455c06d674519f0a74ac7a37f23c38628c4dbfdda93d9bc779251e782a21e8439a6fcc308f4f897e1b5d503e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
90f7be92fc9f8a36e9b78a7d6850074f

SHA1
03a8b6c76e17bbcf3a4827ca878076ff28c50784

SHA256
0ff1b37ef481a128ddb49b4911a1b7d500783e9e188718043ff78c7fce484284

SHA512
6f6772f355a04795d4d3bc146cb790155760ae75cd96b10bac0cada63c42f8c73b54efeac6040f6df81a00ee9b18f71ed7fbfa0c157f550b7d10558dd153e1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
d86784bbe22928dd096e1a91e33bbfa2

SHA1
905997b93c996965a77dcaa12b1cfc30b5347512

SHA256
c6200b12906974b3d9a099ab37c227ed67f792b4a1881d0092c39d6487bb0365

SHA512
b6cb5203678f111eab06f17fdc83ed96c4a5e6990c9c23658b9dcefa4936c0273ed022b088436771ff3da6148f58244f7a7940d736065fe26222902df86afff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
9bfd6cb2f9621293729710a683210b0b

SHA1
ef2ee9c6531463ac2046cd25c863017c1ab8cb05

SHA256
99c7fa28f4aa5f701a1a03a9f0e2371792e68374dad34ef739ad0e63fa8bbc96

SHA512
d134eb093d60f048335567c930cde8261e41477728ccb14a7d6bb2870fd5d057b0b92f3aa79dd2dcad24a9c32dd655cb4b4a6fd0b236b112d10fd813d48c3976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
2a07dbd5c2248b7592d903c3b9ad9364

SHA1
d110158e7247bf6f2dcf2cfa9514f0d2a60f3643

SHA256
17413a981eed3cf2ce151eec781e793f988bdb6a893178e030c187ea00fa00d8

SHA512
7f02e4641f2077546f955f1c217a12fb01393269c2b7f47492cf12eae206adb5322558a045773f297fc8dee3b11d9abc3dc742586ce46217076d94ed0f8869de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
412d5af994c7dd83abe6ae2f2cd0ba79

SHA1
7d54ca0f0e2c5a907d9126aa95ade158e6a7f1e3

SHA256
b8df47a1ce5f7eaa939b4c8830db116a3465562147e074729e81de6e652f825a

SHA512
d1a97ba9403d6386ad2398964b5afe1e517bb2f30403b6f539871d30318bc653f52412a3601ae9cf47184faa5d4a3c507018ac5d2474a2ba07232198b93d9beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
fc81232294e04afff437c8b36ff7c2a8

SHA1
d8a99ae196aac4188a5f89fc0e3e1e91726cc528

SHA256
d54fcc6d6831472a31335ffb6292c24e2d30c5cf420999701759322a049b828c

SHA512
b7a8db6e1ce5a6960b35c31d15643e9c76aa790f908c665ba28bb45ae83ad2f88021bd6ec49fa08d0a3126d3fc22be069685cfc1d7873620d1964868f1b6cb94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
83d2a975d02b78d373afb30b160df996

SHA1
236196e6dab96360b6ec6ce5cd03d7943231d3c9

SHA256
a1480ce8acb58222d74321ae40187e4b6537a7e148b68ca8d2f7e3a91bb38b68

SHA512
5e79989efaa10c955fc0c5f4038b0de76a6cac3cb92f5088c934b6ae02b0034d5cfde789c7f17575eaa3757e9a6bc1aa30d6ea635fea6dbc67e00f91c27fedc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
0f9a4a006477802a493d413e8843e65e

SHA1
d019add9e7dcfbab4f407233e96f69fa6765bbba

SHA256
8adb06c12c7f3b0065e5fcb6ccbb2cac213109f9e0d5848c3745e078d7048de0

SHA512
edd52f0e771ed5e2f7cd771160e3ea760e23bc748dcdc233e69c86710679a053d8612818dec105ff67b7e322177e786fb445dfa602932646a163874cfa2e6ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
34ccd462cd3c08e55c6f199fcba8f5ea

SHA1
3a4aaf47c93b53afd8aed249b1a6b0648c2fa048

SHA256
9045b23f6ee8739e6f93d36de7653f0d6889dd8890b82929326fcfd2dbba0ab6

SHA512
7dc8f7faa3a964eb10a821781bef2214411ce208be700586f9a3827f44de754e5b517108f93df8d22c0fe95a17aaf09bae357de975b3dfb82a5b51a260e5d12d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
806ea8e1b46049d9c0ef373dcf1af47a

SHA1
550ee154ee9c6892fd50109bbc43491271a91b5b

SHA256
6cee6f7909adfa45f1a57f914e78b560de942aba71c566375721a36c5affe36a

SHA512
a592f92c114b1a58551a96eefe1d9770e1bd1c2b14c9d128fbbbb22e9be8fa90b096c371774d7ce7efb544861ae06ca4f53d3a12e4b0884e73fd4bae5aee9eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
029db0c6d351f3ba856c9e20e9ba7f29

SHA1
3c7187aec85fc59f14b8e7b238af2955cc961fa4

SHA256
80b4197f2188dab0f8446a5213a21e46e11d30df3342e647d984787554d46bb4

SHA512
dc8a02e16bcb84d656b9dbe0031367feeb416350ae76241d68f6a72b7d66aa94fb1c465b01b30e2c1b3af4192dfebe22bb619b47b484b4d478a887d9a63ffe97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c87d77e0051543cacee013c34da1b2ee

SHA1
7e4a90d858ea6ae24ac1c1ce71d0db3463dc4596

SHA256
69b630fdc5bfc6ee0d29bc51c54986416423540a807d4c45212f1053299d3b5e

SHA512
b9001d54ff2c5160b37c28c72cfe75aa41a6b1aef5d8110d297dbfe42ae8cfcc96d434ea2441f4ab6118e256bd63c1a7ec402ff0a81b5a20f42000da77150c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
6fe3d8f75f215dce3c32af52a91d8520

SHA1
3ec6689268969d5133061734b67075dab5a5cbc1

SHA256
3118cfaa214eba814228802d07cf287b7dfd6410c5ab1bc75e3342c8c3e4abd2

SHA512
3c0dfc203ff2fd2d14e8fc80dc2f3e3b2a0af7a2d5205f723e06dcb22835ea956a775461341d7f0dc9a7ef998e42f47590d362ebfcd89ca6fef6f700560d4be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
9acfdf21d042360c331dcf2aa9282a71

SHA1
cd63e3f3af20c6027225b3db4ba0754764a24aa3

SHA256
3bf2d0ec05c2190af8dd27ee8613d16baeec301ccb442656a8a5c3e7252b18bd

SHA512
a7ac401a3d3d6598551479058e3b2da6f74eb30270296e8457833ff220efb48d0ce088affeb5d90eccc64328acd57602eff79500e3c874d0b7c27da1c3fc662b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
426f06fdf3f1a8bb6d2c4ca3d0423756

SHA1
f5539ee546853cd9dfe302268cd2bbfbae77a156

SHA256
c493d2d1261e8ec9f29c905e0ad5c6de1371d801e03be72c6ce6427274c49284

SHA512
3323240b1e830cecf54cfc1336cf379b83ddd9a3f8dfc9f92991fdc7cc5f5f353ed1f684714e7132bb6c81d3e584a277d4499e04feae0cbb9c177c2f23dbd217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
45446c046cc62808d19c5b6eaed858c7

SHA1
0df85da9aff190bbdac93c5e9e572ba786723361

SHA256
7a63924b94efa694da22d4b41f52573dac2a16783723634126c5965caea093a5

SHA512
9d97ab7f2c5056946529dbcb7142a0f61061c7b854482c0a75964b4606dbd97f436f85d74a177153d3f03de1db63704729a483c017203a479cb467126f94785a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
56f2554b928d5af833a4a727b1e98703

SHA1
6d6f60c31a7a5b156052fb2ff489276bad753fe6

SHA256
7bed7f7b2344dc63c51b0f69ceff27d2a78ec9e6a9195633cf5ee7d792a214d7

SHA512
91f7ee57e5b585e9a5c26ba429a98a9be031554006baa5db99809e7e667e46e3857bd943ad76c58f885fdf4320e3b84bfada7f935f1e8ba36869d1a367f299a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
ea1be2187dc0884632fa9351d0964007

SHA1
b12541964880930804b7d2bb633176e7dc506d46

SHA256
db9689c7ad5cb532993485ea1c0911411a0b233a52a2aa4235532ac587311616

SHA512
a8fc13be7ccc20e050a39a18a567af91ac52c090e97a765d498a3d920df5228b6b3b433533647d94e3e4dac39fbc28a4885aefaadd1031025e23db925b833459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
0d90838c3538975614770aa9d79c91fa

SHA1
f3d024483842bbfaa2ee9ad35811e0e2dbd8fb5b

SHA256
f4e7bb7978037880dfbdfbb4a108468bcdca3708a2fd28047a085bb214b3e3df

SHA512
b413daadc40ab3a1b838359bce22bc3443f8be9978109320fcf54aef856dc2a6adccb6b41fc7c5dadc334c6ba47885f7dc6480cdb9cb3a7b942abb876a1f43e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
4ba455d67fa5b9110ed5c8b4e49797bc

SHA1
be38f573b9f30700d02abc426fe92f7b6664733c

SHA256
aa4fc97cb94285e9696d7a577a008c814fbe8eac0344da9f0c8b7be432a67145

SHA512
8757509c5a236fa704d42faff620c7b6faa890dc2bd1701fc0c07fbb7cc5814fd677bb03e91eee68f0b2f71fb60e8649656e98ac48cc8470cc639e5cc52b7143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
09382f18d302726aa9e17bdfc7003904

SHA1
3fd06cb4cb6beaeff26ff94a45c794c376d352c3

SHA256
dd47814a8be9883e18a6ae43c2fe4877af3cf8440ff6a28bb9cd058ea2a2e4bc

SHA512
ddfb103f377414ad53f56cab1213314a4257d975c96cb86f9aebb454709040bfa63bd32e2ef40c84ca066a21bf638f8474c8833e8e9cd57f7ac91543583e6905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
708c5863f0f2dc4357151dcc8b78f1b5

SHA1
8dbdaadfa42932dd38ee4ed1c63e545a1d316d7b

SHA256
513b1cb74dbfbb419b7167718303f2ffe2bb29bbdad88841985843ed6004e3dd

SHA512
0cba858ecb8dc9da13991ac178bde3b69c26838ff3732a27c6ea83b6472e59b6d16d1c62b3914612fb7b88a8e75968a3f53d91097744830640aff423494e6a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
79dbfa94ecd62dc313b4df4f40437d6c

SHA1
662cac7da5493930dfea9a09191ec81cd11462c6

SHA256
0862b88bc36686c4da4cf6e917cc4f88ed1dfb8b360b813500ddb20f2e4ad243

SHA512
29e14644a75b13aca4e57a06000752c6bf8e407334c0ed44f8e52ffd5060f6a24d43c18f597a0b68e74bc627672463c1c2b05fb4438f4b0da490ae130af6ffa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586915.TMP
Filesize
874B

MD5
d67733e7b177740a51f3d186a35b96ae

SHA1
c3da6a120d92db1afabde251cf5c1a62719d3c6c

SHA256
11867d4c75cd7805e1e19594aba8e61ec099cd2f84228cd426c03b1810db6b2a

SHA512
dc8a7d13f46d624f068674d7d4bce9075180795925c436a84b3e0cb77a51ed1b4447706045f896d09d5c43970e0236a12de783714cbb02878254fd8a8419fc54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
f4375a1d87f91d5c1cf1850cadc32733

SHA1
ceb223d858d907e3bb402e20eadef7f53fb2b797

SHA256
86465fcf3bb15a1d98755477151974d2de5c6c1cfce835b77c2d9e3c4aff5189

SHA512
ef876eea414ed4e6657f70327b8fe2fc90ecfdc47db809c1ff1142d10150e5041620729a9365a9e54e621edc30c1e48c554f7b895adf4733b4649ce8804a7b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
5e557f8a55243114d283890b2884c083

SHA1
7d201474a68d4112db5e4671a8add4f96e0cc2ce

SHA256
e4d0b1ab628ea563f6021b6c781c1a1f65ff88afa650b80925ec7aab87d3478b

SHA512
b6e97f0b302ded37c6c2b2062c20655606f1455513f15632e2767c3f3f70b274bda95b31d1bcd3bf38c6bf9b71ad190e7eadaa51c47e60cbe6aa9db72dfb20c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
10KB

MD5
82e163e7fc82d9489e3f49c9968183e9

SHA1
6377fe7b7f138c672672a0ea3ec9803fc2da675c

SHA256
ecefaae553034bd27f84ce089d7d5e2863e2cc8599a2ffdeddbeabe673c52f29

SHA512
cb0bb1472a75626f0db45f232ff764bb89bad11930f7e664d2e2767c9495d10b532c4d3fc7af102f5e572285eb16f2a1e26a79021001973eb0fcdbe746657870

Download Submit
C:\Users\Admin\Downloads\Facturacion_07762.7z
Filesize
15.2MB

MD5
9f72219b487d1eb7af0f2d5128403a09

SHA1
0b2dad56f74752d7b99a92500e405ba5cd1d5d58

SHA256
c95cf5918d9690d512ba32974c421f2fc681b5e93069b14de8863050e10361e3

SHA512
0cdc9d763bdeb63fd49701992a763195e25389d63ff9e73e30eaedd756fd430cbedf264676a2da7c6bdc3b3bfb6f8d068f60b75cd6898e844c922f634e6b3fc7

Download Submit
C:\Users\Admin\Downloads\Facturacion_07762.7z
Filesize
15.2MB

MD5
9f72219b487d1eb7af0f2d5128403a09

SHA1
0b2dad56f74752d7b99a92500e405ba5cd1d5d58

SHA256
c95cf5918d9690d512ba32974c421f2fc681b5e93069b14de8863050e10361e3

SHA512
0cdc9d763bdeb63fd49701992a763195e25389d63ff9e73e30eaedd756fd430cbedf264676a2da7c6bdc3b3bfb6f8d068f60b75cd6898e844c922f634e6b3fc7

Download Submit
C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
Filesize
20.2MB

MD5
c42e37aa1d41307e39a53ee327d22b9c

SHA1
f04b7f7f267ed025af8e18ce7f0ca589c5592521

SHA256
313fef1d9a30fe8a40f4a8b1aefa74dbae9b4a6a1b33138bf694df1af29dcf59

SHA512
eaeb6db090b5e350fef96d7d2217b03bd8ac1e4e45ef001792aca41dfb508f0128a41f76266a0e45a140aaf26825d4167c73308e71f6c89537b36bd3deab2de7

Download Submit
C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
Filesize
20.2MB

MD5
c42e37aa1d41307e39a53ee327d22b9c

SHA1
f04b7f7f267ed025af8e18ce7f0ca589c5592521

SHA256
313fef1d9a30fe8a40f4a8b1aefa74dbae9b4a6a1b33138bf694df1af29dcf59

SHA512
eaeb6db090b5e350fef96d7d2217b03bd8ac1e4e45ef001792aca41dfb508f0128a41f76266a0e45a140aaf26825d4167c73308e71f6c89537b36bd3deab2de7

Download Submit
C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
Filesize
20.2MB

MD5
c42e37aa1d41307e39a53ee327d22b9c

SHA1
f04b7f7f267ed025af8e18ce7f0ca589c5592521

SHA256
313fef1d9a30fe8a40f4a8b1aefa74dbae9b4a6a1b33138bf694df1af29dcf59

SHA512
eaeb6db090b5e350fef96d7d2217b03bd8ac1e4e45ef001792aca41dfb508f0128a41f76266a0e45a140aaf26825d4167c73308e71f6c89537b36bd3deab2de7

Download Submit
C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
Filesize
20.2MB

MD5
c42e37aa1d41307e39a53ee327d22b9c

SHA1
f04b7f7f267ed025af8e18ce7f0ca589c5592521

SHA256
313fef1d9a30fe8a40f4a8b1aefa74dbae9b4a6a1b33138bf694df1af29dcf59

SHA512
eaeb6db090b5e350fef96d7d2217b03bd8ac1e4e45ef001792aca41dfb508f0128a41f76266a0e45a140aaf26825d4167c73308e71f6c89537b36bd3deab2de7

Download Submit
C:\Users\Admin\Downloads\Facturacion_07762\Facturacion_07762.exe
Filesize
20.2MB

MD5
c42e37aa1d41307e39a53ee327d22b9c

SHA1
f04b7f7f267ed025af8e18ce7f0ca589c5592521

SHA256
313fef1d9a30fe8a40f4a8b1aefa74dbae9b4a6a1b33138bf694df1af29dcf59

SHA512
eaeb6db090b5e350fef96d7d2217b03bd8ac1e4e45ef001792aca41dfb508f0128a41f76266a0e45a140aaf26825d4167c73308e71f6c89537b36bd3deab2de7

Download Submit
C:\Users\Admin\Downloads\drive.google.com.har
Filesize
57KB

MD5
cd59ea34810ee4bdf734bd235b4ab7e0

SHA1
f4031c14668d61fba762c9df70fbee7c759f8ba0

SHA256
426aa73122c2a4226155aa7744d6bd1b2cad9564a0d4ff492ffb4baadacb7ced

SHA512
ff864f18fcdd833b86c11c365ad238a404ae34c3e69de62633eac5a46a464a96db67fb9e53a189870190366dd8ae6e652f02be03dc22022a1d495b510c496254

Download Submit
\??\pipe\LOCAL\crashpad_4700_ZFJVSUVCPSKNLWBC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/472-424-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/472-398-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/472-369-0x0000000001A00000-0x0000000001A01000-memory.dmp

Filesize
4KB

Download
memory/472-415-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/472-409-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/472-408-0x0000000001A00000-0x0000000001A01000-memory.dmp

Filesize
4KB

Download
memory/472-400-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/948-361-0x00000000035F0000-0x00000000035F1000-memory.dmp

Filesize
4KB

Download
memory/948-382-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/948-364-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/948-397-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/948-319-0x00000000035F0000-0x00000000035F1000-memory.dmp

Filesize
4KB

Download
memory/948-335-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/948-367-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/948-436-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/948-362-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/1080-448-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1716-414-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/1716-433-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/1716-392-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/1716-401-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/1716-404-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/1716-416-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/1716-410-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/1716-425-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/1744-385-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-371-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-386-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-384-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-370-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-390-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-383-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-388-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/1744-411-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/3308-365-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/3308-366-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/3308-363-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/3308-429-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/3308-360-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/3308-358-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/3308-322-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/3308-381-0x0000000000400000-0x000000000184F000-memory.dmp

Filesize
20.3MB

Download
memory/3308-317-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/3392-399-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download
memory/3792-434-0x0000000013140000-0x0000000015265000-memory.dmp

Filesize
33.1MB

Download