asyncrat | 0da3d0ead006ea4191e398ec6bf50f3da31b1efba6d5e11a2b415c0f0c07b934

Analysis

max time kernel
138s
max time network
302s
platform
windows7_x64
resource
win7-20240708-es
resource tags

arch:x64arch:x86image:win7-20240708-eslocale:es-esos:windows7-x64systemwindows
submitted
17-07-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NOTIFICACIÓN DEMANDA PENAL DEL CIRCUITO A SU CONTRA DEL JUZGADO CIVIL.msg
Size

376KB
MD5

bc6c3c91aca31fde62e19c5379f03a1f
SHA1

fef037b3ef03b1f4505fa5d50aa8b3583e2902c3
SHA256

0da3d0ead006ea4191e398ec6bf50f3da31b1efba6d5e11a2b415c0f0c07b934
SHA512

f5d158297270ce3cc9bec66bfa5a197e268e229667d6f7155b905d8050a48da88d1e7a4025ed02f0d284bb903b28038a31cca803710a1b7cf4770763e7326efa
SSDEEP

3072:9iQ/8IhK8EUPAYt+vjoEuK7n49l6DVwp/Voedv3yNF2XEOo8r1z8KU/g+C8dC8f1:38IhK81kRTf2TE

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

LILA152511.kozow.com:1234

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 1 IoCs

pid	Process
2616	01 NOTIFICACION DEMANDA.exe

Loads dropped DLL 3 IoCs

pid	Process
2616	01 NOTIFICACION DEMANDA.exe
2616	01 NOTIFICACION DEMANDA.exe
2616	01 NOTIFICACION DEMANDA.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2616 set thread context of 1092	2616	01 NOTIFICACION DEMANDA.exe	57

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "96"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a0000000e0859ff2f94f6810ab9108002b27b3d9050000005800000030f125b7ef471a10a5f102608c9eebac0c00000050000000920444648b4cd1118b70080036b11a030900000060000000	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "3"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 9e0000001a00eebbfe23000010009fae90a93ba0804e94bc9912d750410400002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbeebaa2b0b4200ca4daa4d3ee8648d03e58207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewVersion = "0"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_FolderType = "{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	OUTLOOK.EXE

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\U5IPUKUQ\NOTIFICACION DEMANDA DEL CIRCUITO EN SU CONTRA.svg:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\U5IPUKUQ\NOTIFICACION DEMANDA DEL CIRCUITO EN SU CONTRA (2).svg\:Zone.Identifier:$DATA	OUTLOOK.EXE
File created	C:\Users\Admin\Pictures\NOTIFICACION DEMANDA DEL CIRCUITO EN SU CONTRA.svg\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2704	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
2616	01 NOTIFICACION DEMANDA.exe
2616	01 NOTIFICACION DEMANDA.exe
1092	cmd.exe
1092	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	OUTLOOK.EXE

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2616	01 NOTIFICACION DEMANDA.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe
Token: SeShutdownPrivilege	1156	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2704	OUTLOOK.EXE
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
996	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe
1156	chrome.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE
2704	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 776	1156	chrome.exe	35
PID 1156 wrote to memory of 776	1156	chrome.exe	35
PID 1156 wrote to memory of 776	1156	chrome.exe	35
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1588	1156	chrome.exe	37
PID 1156 wrote to memory of 1860	1156	chrome.exe	38
PID 1156 wrote to memory of 1860	1156	chrome.exe	38
PID 1156 wrote to memory of 1860	1156	chrome.exe	38
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39
PID 1156 wrote to memory of 2040	1156	chrome.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\NOTIFICACIÓN DEMANDA PENAL DEL CIRCUITO A SU CONTRA DEL JUZGADO CIVIL.msg"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1136

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\Pictures\NOTIFICACION DEMANDA DEL CIRCUITO EN SU CONTRA.svg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5e29758,0x7fef5e29768,0x7fef5e29778
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:2
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2240 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2248 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:2
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2272
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140237688,0x140237698,0x1402376a8
    3⤵
    PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3264 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3388 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 --field-trial-handle=1372,i,4409043330702460403,3530667461884916765,131072 /prefetch:8
  2⤵
  PID:1656

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2892

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\" -ad -an -ai#7zMap11288:186:7zEvent14815
1⤵
- Suspicious use of FindShellTrayWindow
PID:996

C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\01 NOTIFICACION DEMANDA.exe
"C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\01 NOTIFICACION DEMANDA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    PID:2472

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
PID:2820

C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\01 NOTIFICACION DEMANDA.exe
"C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\01 NOTIFICACION DEMANDA.exe"
1⤵
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  PID:1656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    PID:924

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\unrar.dll
1⤵
PID:392

C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE" /NOSTARTUP "C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\sallow.mdb"
1⤵
PID:1432

C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE" /NOSTARTUP "C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\sallow.mdb"
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
67b5ed7bc96bc73181e399381ba92e2b

SHA1
f8f0a5de279e1b14e07296462ef8a6524226ea12

SHA256
583a06148b76b8becfb7d2ffa68dc5b04fbd63d1c13c4d0f59d53ea3ecd0f6ec

SHA512
62c6e7a47febcd6330b11d059c5f7800b385f38f83280b3aefd5beb00839e8ea2f6a01df35db9255acfa88aea3a2a1aafad5a204134d44350965cfef4f186477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
bf58a1f4b77c6c73fe6e04c47b2a3e10

SHA1
bf4248406362621c42988c76f0d1c7339c446321

SHA256
fbb3476e3e14d925c2725fcc5416942c4a443637fbab42bb5574e6455130040b

SHA512
5fc3772cb09dc8f989d6a241ba392d304146e27971fa6d9986d6fb54e078c04d6b9cdb84587d4464ae967cf508adc3dd5c627557b37ed3b750829bfcd18a298b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
105141a923a7e2372e7df6f082dd02e0

SHA1
4d8d82fdbea2e786beea1cca3138a5d778f5f3e9

SHA256
71b0300a94d92c19f4960ab6091dcc7224860ca528ba6864fc4f9497bd04ce8b

SHA512
92654d1847f62495df7812e6a676de922ad7f712fe6bcedeb6c5335bf6672bcb77ceed331ff2595cba41ac7d7f33ac477cec04b33c596ab075d7d392e6d0713b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
85e61f20572883cd36750e511d0e0175

SHA1
513f1684a313f0c136b76daca29a7e2316f70400

SHA256
6577e75ea7af156ab7e7458e66033c74c9085fc307f6af08bf8b286407f9fca3

SHA512
e9d9710c19e6decec31e01e2682bd8aa76738d1fb1b1cc2921ef56653198f94dee1ccaaef41b7bc0bd0a73ce126ca994629057ed2c1f5bbd7fb87d78579fcd60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
307KB

MD5
62239befce1e179525da8374f388f701

SHA1
a2d933132223726644b0e80170240f5301cedf26

SHA256
8d23613b39368f11b147456940c876d5f0da0c7c63bbc82dcfe4c038f9200bd4

SHA512
da0c69f65c4cce181ce94bd2091c7b2c2813e75dfa28d5124af2ea6de30e36d14c88c00c81a2ad75885c1f0dbb401062d147c25ad67b6d8bdf339cb68dad0abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
d8c736a582c54998d11258cb3bbab606

SHA1
93fdd0f477e8c07bd486e9068a3a6bf78d6f0222

SHA256
a495fe1a46a58dff94d561030f72d0f41fdef52de1e3a5820b07d1f99469b440

SHA512
a6c1c9a4a99fb0d09e35ec2e780bd8c8049c4ef878b68a8e2ca0b36c3bd200411959c7ddc1795cdf2b334191446b040cd50b586f46d087dbe8f5dd9f2963277b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
6717d0e4f14940844626e0bc35903919

SHA1
2f6d6d260f60f89c8c6ced4dd67ae65bb3d98584

SHA256
5e6b120ada27aa1a39bbbd8aaeeb85fcd3371b3bba966259feaa27a20be3cfc7

SHA512
b749e599125f788ab1ae55a80cba4e245c0c81ddab980a589e8e4844a156ad6105e27aaedbffaebf822d5186ce16ec96cd707585bd0cd13a92a8a924e2173262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\U5IPUKUQ\NOTIFICACION DEMANDA DEL CIRCUITO EN SU CONTRA.svg

Filesize
257KB

MD5
48bbb261b5c863f40ae0cc2c6efc2a1d

SHA1
c7e883627c324453a1938e086fb626830c26de40

SHA256
b8907e83c3a1ae5e982f192b305b63b6ed554ad0aeaad37d1c93af23dfad6229

SHA512
5aad401f3e1ae3f861ddc842339094cd07de0757ecd94cd844e44ad9b5eeed48713c2e30fac43fe674f9626e65a3164f79042a2a507863ecdcc2b53325cc0cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\694f1bec

Filesize
774KB

MD5
c0d7e219147c50ed0fca27ba4dc81f28

SHA1
db14f314bc79badf9563b05c7bf453beb8d687df

SHA256
4a7710ef500146bfee297db5f730eab02039642f3385c8e01781222aa9c163fe

SHA512
7ff5d2f5d329119b9054f5d6a595ede2ea87a289791f0177d010ed2921c1e63dfcfd007a7d385aab765f62bbf1aaaa23522b5635f81ea843f5b5a85d5be16885

Download Submit
C:\Users\Admin\AppData\Local\Temp\74490d9

Filesize
774KB

MD5
6bf68fefc979b2a658dfafca73cabfc9

SHA1
5c45fb23d0a257e62f80a21d771748406fbe48a7

SHA256
07d26dc5df080c7e0e41a3d4e61d4e46fe80d6e972ba889ec76b6cb7c18e3f73

SHA512
a3ebfd4ff9e930cf490d574837e5e39ece1a47d30de3d1846272d58666cd52b0b1f750c2e5de659061a6604503f4f7c0ab6ace6264768147d261f72a90cfc385

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2712.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Access\System.ldb

Filesize
64B

MD5
3818d0ee8641355a4e6cc67a933c7d59

SHA1
c59f6cb23b73c73ed27d81970e7533e6a674c872

SHA256
058a73073e612b071ce6bb4cfa0db5a8b62235ddd3aefea6482eef869e854117

SHA512
808dcdb7c8133611fbdceb8c56c83eaf5c73415328cd009dbaf8178a0dc1b33830b88d038e4b2b276955ae8948e3e33f15742e30787ee9e3cfab40b0902b1b70

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Access\System.mdw

Filesize
124KB

MD5
7bb499604a0b5ce8b231e0d72e46dc05

SHA1
38a38042384a8a008d91bd74e054541d21495fef

SHA256
cb1148e1b8291908849cf11e3be2840e73b19ce4c301b1b8386bad1de3a58b16

SHA512
11f14b5d42c07bb7f8fc0f96000f36b9d46587e5e7657ac38d3724b247319eef37923de0237c59c4f8de397dddcb53c707fdf50de9b55d5858458b3532c0d235

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\Database1.accdb.LNK

Filesize
1022B

MD5
401d2d71052878e630275b8c82c75de8

SHA1
b2dff9c437c1f7ff7dd4e49ef55210b51249f106

SHA256
25ae3e4ac1691fd3efb4022240d99baa78feb99867a89314679c6a0f343d97b3

SHA512
d47f6d5d695bee4acc1eae4934b2013e1575fff9d9ac05ee84e679c709147858fc7d494565910798ec9cf996de44b0103728d7faecdc114065f8920ecdceeb08

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
125B

MD5
77c0f5411204504f1c942d0abc196657

SHA1
35178b56d62ae94badad2897413f0f2b4772106e

SHA256
60c4c594506c70bb03b89b0ce98beaccec215c09cdf481bd222b6222edb4381f

SHA512
541bc1c57e43342274c4ea72a7d5eae36e005ca05175343c74aba49d1a2dfc8d915249447d56a4284a3c72ee25014c31cff80060663228ed41a3bdb7f5ae2470

Download Submit
C:\Users\Admin\Documents\Database1.accdb

Filesize
336KB

MD5
abb8a6bf03ea07424cb3d41343895f37

SHA1
2caa487821178b1e96fcb85241d4b718db07b908

SHA256
824f3e3813382d8e0da7551f4a61ee8fc7fb43d44bc84a18cdce73bd4f0e9fd3

SHA512
99e121b1030899a95ece5a6bb78e431ea2307b48f09e84ab5b1e849606bd4e7ea67b9a2d3e8fe6d3e5c89615708d7c7e475b65338f58c18f0dcc41013542490c

Download Submit
C:\Users\Admin\Documents\Database1.accdb

Filesize
352KB

MD5
10e5f32a6777b1192801334e671755ff

SHA1
f34cd5a8b307145b4d6739d0e2d51bb5b164b242

SHA256
c9f4b99dbf1faec48cb615f8b51d78567f3003c16337ed2985f99b07c725ffc1

SHA512
4141a5ea62ec43fbb105327b3f07d43e8a2aec9b445a74af56562ce94fb58eed86df6b3dae3766a8200166328f8e82420b533495c7a16d0bd2e2c3828eb62d17

Download Submit
C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO.7z

Filesize
1.9MB

MD5
66dd520f80573d7ff23d42a47beb4ead

SHA1
387f42e4e128047ae9f33a809220bfa256a46f96

SHA256
0eac013da0383a5157882f907007c7622e92baa54a04021cd4de034799518e4b

SHA512
75a4cc0a0692677801315463b5f1ddcf7676d43f2389029f0ff921c5f12179b9bf6cb076af908ffb9bc2744c9bcd0e9056b360d3bdcf874b6977a9404f5d18ee

Download Submit
C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\01 NOTIFICACION DEMANDA.exe

Filesize
3.1MB

MD5
b841d408448f2a07f308ced1589e7673

SHA1
f5b5095c0ed69d42110df6d39810d12b1fa32a1e

SHA256
69a90665113bd73b30360d87f7f6ed2c789a90a67f3b6e86474e21273a64f699

SHA512
a689734048109ab7bec9491bbb7781686c19c7885166b3ca2975e2f49e956fcc388cd8ca85a4e5a8bf9efe6056f1e0d80197b7f521d4f0d4cadb10ba9ef1fa93

Download Submit
C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\mvrSettings32.dll

Filesize
1.0MB

MD5
d168f18b79f9f33690f011d1deb1e7cf

SHA1
cf0d984ce101ec274e65e88fae07daeb26de5a6d

SHA256
b7d3bc460a17e1b43c9ff09786e44ea4033710538bdb539400b55e5b80d0b338

SHA512
bbf085bcbc3c1c98caba95bdf48051bac18bbd1b7314c7bb55b56e3d423fb34758cc239c237091486cc466123bf02844eaac3b4435cb535af25dc2bca625af71

Download Submit
C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\sallow.mdb

Filesize
542KB

MD5
25b310983b0eaf6dd02900b93a10aca0

SHA1
2ebb582f2192ec472886411a290477c793c01f5c

SHA256
8244e12c0d52d8a3a1f1375d345413e8915505246c6d0b747b0abe66b5b1a46b

SHA512
e62dc330a108594f96d037b95b8a0ab520c6fd0c04a90d08cc7837369d77c00876de913134d89c77493e478d2fa4cc4f20fbf2a7451ecb1843d6997701e2f319

Download Submit
C:\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\tape.eps

Filesize
90KB

MD5
10d8e1cb3cc0836ee187c96073c19dea

SHA1
66ab184641c479289480048c57f67ef7247c6c40

SHA256
df5bd65b747646a7cfd95dbd4f67c27f668e1023afcb311caf24c9a0ff2057c1

SHA512
26ece3213774edea398353105932d4c4ed10277071b2e7008767ca9617ac0836f79ac17737ed12d06292ccbfe234cd23877aa37da3b21049ab714c259665346e

Download Submit
C:\Users\Admin\Pictures\NOTIFICACION DEMANDA DEL CIRCUITO EN SU CONTRA.svg:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\madHcNet32.dll

Filesize
921KB

MD5
2ba4099eb6fbac4eaae2d6dfe71b4e18

SHA1
fb6c32e1589cfa0121e15606932671f27ee963be

SHA256
8bd3edbf027972636bdb4cbb46037f0be98ca233e19b003e860af0bd7526a0ac

SHA512
953fe3a3328b871aac6ba9ce1242efa8e9d567f50eb22b3afee549ec9a83192b61ee479ddae44a5a63ee6594e8a73afda521f538f2e5eb750c15a00541864241

Download Submit
\Users\Admin\Downloads\_NOTIFICACION_DEMNDA_EN_SU_CONTRA_JUZGADO_03_PENAL_DEL_CIRCUITO\-NOTIFICACION DEMNDA EN SU CONTRA JUZGADO 03 PENAL DEL CIRCUITO\unrar.dll

Filesize
304KB

MD5
851c9e8ce9f94457cc36b66678f52494

SHA1
40abd38c4843ce33052916904c86df8aab1f1713

SHA256
0891edb0cc1c0208af2e4bc65d6b5a7160642f89fd4b4dc321f79d2b5dfc2dcc

SHA512
cdf62a7f7bb7a6d511555c492932e9bcf18183c64d4107cd836de1741f41ac304bd6ed553fd868b442eaf5da33198e4900e670cd5ae180d534d2bd56b42d6664

Download Submit
memory/924-494-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/924-492-0x0000000064E10000-0x0000000065E72000-memory.dmp

Filesize
16.4MB

Download
memory/924-495-0x0000000000080000-0x0000000000096000-memory.dmp

Filesize
88KB

Download
memory/1092-370-0x0000000077060000-0x0000000077209000-memory.dmp

Filesize
1.7MB

Download
memory/1092-400-0x0000000066A90000-0x0000000066C04000-memory.dmp

Filesize
1.5MB

Download
memory/1656-477-0x0000000060220000-0x0000000060394000-memory.dmp

Filesize
1.5MB

Download
memory/1656-470-0x0000000077060000-0x0000000077209000-memory.dmp

Filesize
1.7MB

Download
memory/2296-464-0x0000000060220000-0x0000000060394000-memory.dmp

Filesize
1.5MB

Download
memory/2296-446-0x0000000077060000-0x0000000077209000-memory.dmp

Filesize
1.7MB

Download
memory/2296-468-0x00000000008F0000-0x00000000009FB000-memory.dmp

Filesize
1.0MB

Download
memory/2296-467-0x000000004A600000-0x000000004A6EC000-memory.dmp

Filesize
944KB

Download
memory/2296-466-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/2296-444-0x00000000008F0000-0x00000000009FB000-memory.dmp

Filesize
1.0MB

Download
memory/2296-445-0x0000000060220000-0x0000000060394000-memory.dmp

Filesize
1.5MB

Download
memory/2436-500-0x000000000C270000-0x000000000C272000-memory.dmp

Filesize
8KB

Download
memory/2472-405-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2472-403-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2472-404-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2472-402-0x0000000064E10000-0x0000000065E72000-memory.dmp

Filesize
16.4MB

Download
memory/2616-367-0x000000004A600000-0x000000004A6EC000-memory.dmp

Filesize
944KB

Download
memory/2616-350-0x0000000066A90000-0x0000000066C04000-memory.dmp

Filesize
1.5MB

Download
memory/2616-347-0x0000000000230000-0x000000000033B000-memory.dmp

Filesize
1.0MB

Download
memory/2616-351-0x0000000077060000-0x0000000077209000-memory.dmp

Filesize
1.7MB

Download
memory/2616-364-0x0000000066A90000-0x0000000066C04000-memory.dmp

Filesize
1.5MB

Download
memory/2616-368-0x0000000000230000-0x000000000033B000-memory.dmp

Filesize
1.0MB

Download
memory/2616-366-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/2704-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2704-189-0x00000000053C0000-0x00000000053C2000-memory.dmp

Filesize
8KB

Download
memory/2704-176-0x000000007345D000-0x0000000073468000-memory.dmp

Filesize
44KB

Download
memory/2704-1-0x000000007345D000-0x0000000073468000-memory.dmp

Filesize
44KB

Download
memory/2820-433-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2820-434-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2820-436-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2820-432-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2820-435-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2820-437-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2820-438-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2820-431-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download