asyncrat | 6768f27cadd154e4f98704f815901825550609b11d2a3f871aa3db97d351dc52

Analysis

max time kernel
212s
max time network
210s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24-07-2024 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09-CITACION DEMANDA EN SU CONTRA -JUZGADO 03 LABORAL CIRCUITO ESPECIALIZADO EXTINXION-09.svg
Size

358KB
MD5

4e13471212cb4ed7b3800d329c3860bf
SHA1

5647ce87843802b740ed953c50d80453823dd8f8
SHA256

6768f27cadd154e4f98704f815901825550609b11d2a3f871aa3db97d351dc52
SHA512

6fca249d5601b08f778b42495e01396865d2cb736369a5eba80ee1662fa4e39519c17bf6bc2e9fb44c2034fc0af973336cbae67167bdfdfe9a2826e60f590928
SSDEEP

3072:RCkLBpCoMXyV1d/Cl+XlwdgrJGwS4BHKlge41unusvrvlvfvwvsvQv+xJWv46zwU:RfBpCoK21dE+XlpJGwSsKldhLsuCd

Score

10^/10

asyncrat default discovery evasion rat trojan

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

melo2024.kozow.com:8000

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
AnsyFelix
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 1696	5068	01 NOTIFICACION DEMANDA..exe	94
PID 2800 set thread context of 5096	2800	01 NOTIFICACION DEMANDA..exe	98
PID 1696 set thread context of 3080	1696	cmd.exe	101
PID 4576 set thread context of 60	4576	01 NOTIFICACION DEMANDA..exe	104
PID 4228 set thread context of 3044	4228	01 NOTIFICACION DEMANDA..exe	106
PID 5096 set thread context of 4252	5096	cmd.exe	108
PID 3044 set thread context of 2204	3044	cmd.exe	114
PID 60 set thread context of 4088	60	cmd.exe	121
PID 3736 set thread context of 828	3736	01 NOTIFICACION DEMANDA..exe	123
PID 2032 set thread context of 3552	2032	01 NOTIFICACION DEMANDA..exe	126
PID 4020 set thread context of 3032	4020	01 NOTIFICACION DEMANDA..exe	129

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmstp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4208	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133663102687449976"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2116	reg.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
5068	01 NOTIFICACION DEMANDA..exe
5068	01 NOTIFICACION DEMANDA..exe
1696	cmd.exe
1696	cmd.exe
2800	01 NOTIFICACION DEMANDA..exe
2800	01 NOTIFICACION DEMANDA..exe
5096	cmd.exe
5096	cmd.exe
4576	01 NOTIFICACION DEMANDA..exe
4576	01 NOTIFICACION DEMANDA..exe
4228	01 NOTIFICACION DEMANDA..exe
4228	01 NOTIFICACION DEMANDA..exe
3080	MSBuild.exe
60	cmd.exe
60	cmd.exe
3044	cmd.exe
3044	cmd.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
3736	01 NOTIFICACION DEMANDA..exe
3736	01 NOTIFICACION DEMANDA..exe
2032	01 NOTIFICACION DEMANDA..exe
2032	01 NOTIFICACION DEMANDA..exe
4020	01 NOTIFICACION DEMANDA..exe
4020	01 NOTIFICACION DEMANDA..exe
828	cmd.exe
828	cmd.exe
3552	cmd.exe
3552	cmd.exe
3032	cmd.exe
3032	cmd.exe

Suspicious behavior: MapViewOfSection 15 IoCs

pid	Process
5068	01 NOTIFICACION DEMANDA..exe
2800	01 NOTIFICACION DEMANDA..exe
1696	cmd.exe
1696	cmd.exe
4576	01 NOTIFICACION DEMANDA..exe
4228	01 NOTIFICACION DEMANDA..exe
5096	cmd.exe
5096	cmd.exe
3044	cmd.exe
3044	cmd.exe
60	cmd.exe
60	cmd.exe
3736	01 NOTIFICACION DEMANDA..exe
2032	01 NOTIFICACION DEMANDA..exe
4020	01 NOTIFICACION DEMANDA..exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3080	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 5052	3936	chrome.exe	72
PID 3936 wrote to memory of 5052	3936	chrome.exe	72
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1648	3936	chrome.exe	74
PID 3936 wrote to memory of 1244	3936	chrome.exe	75
PID 3936 wrote to memory of 1244	3936	chrome.exe	75
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76
PID 3936 wrote to memory of 3012	3936	chrome.exe	76

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\09-CITACION DEMANDA EN SU CONTRA -JUZGADO 03 LABORAL CIRCUITO ESPECIALIZADO EXTINXION-09.svg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff801869758,0x7ff801869768,0x7ff801869778
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:2
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:1
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3360 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4652 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:1
  2⤵
  PID:356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1836,i,4189881923707273390,10166577673558254333,131072 /prefetch:8
  2⤵
  PID:1580

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2100

C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3080
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /im cmstp.exe /f
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4208
  - - C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\system32\cmstp.exe" /au C:\Windows\temp\alwvhb0y.inf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3624

C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252

C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:60
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4088

C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3044
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2204

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- System Location Discovery: System Language Discovery
PID:5028
- C:\Windows\SysWOW64\mshta.exe
  mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"", 0, true:close")
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1136
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2116
- C:\Windows\SysWOW64\mshta.exe
  mshta vbscript:Execute("CreateObject(ChrW(87) + ChrW(83) + ChrW(99) + ChrW(114) + ChrW(105) + ChrW(112) + ChrW(116) + ChrW(46) + ChrW(83) + ChrW(104) + ChrW(101) + ChrW(108) + ChrW(108)).Run ""powershell.exe Stop-Process -Name 'cmstp'"", 0, true:close")
  2⤵
  - System Location Discovery: System Language Discovery
  PID:504
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Stop-Process -Name 'cmstp'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2492

C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:828

C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3552

C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Desktop\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
acdad9483d3f27ed7e86c7f0116d8ad9

SHA1
dd2cfd176ad33d12ba7e6d260e1069b1dd4490c4

SHA256
bff5b4fff4b34ed3ea2754985b5ba1a8d6921517b0fa370f71f37ee0845552ba

SHA512
6e3ab4b6cfa73a7ad3c36fa621b1d2817b26e8e3613b78a40df6691d65e1486e6c2281efa0f8d3f30d2c6647b7ba3430a8be77df770f1cc575e8db76be6836a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1011B

MD5
963f689605ee566ba820177e28234018

SHA1
26926706b4bd18d25215b7b20f941d1e8db26cbf

SHA256
1749a30b78261348812d064a2ff05f8d18a125621f6d2bb068da0849ba67f498

SHA512
a5f089eed8190ddb844901e8034d8d0fce9e4c2f721778441326a013801825637c42b08f2b36ad04456b09a466efc5ed4d5ce82b73d7d18553a0a33bf5f2823f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
39fa472a53b776d1ac4c9e1e0152cae3

SHA1
3c6b155194d7af1e2525d8b3bee5fbe253a5dab8

SHA256
0550b0fc31144ae8e79771b71d5cdcda90f27d88a9f549b59aecf0507d0a3137

SHA512
7740bf5baa1224617207be7f5cd22c4991940303bc92584a77f7eff2da8f0d1c65213378ec30ad2d6b38ff9d597d180c6e454965a8f3aee56269754529f7dded

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d4a76017b3a91f3d2d3b483390d554dd

SHA1
dc73cfe7a3ed1fd5cf97d5104615950b60bff5fb

SHA256
8012ad2c4d0a1f96dc174618c13e7b1139a66ece2a33f42bd3c93b01d4ccaf26

SHA512
ff74d1ba87c3af363d3e6435abdc6fe9d4ccc9cc7bfd5e19ec1e2e76d9ce613b738f1bd30d3489ebcc3e44ef6d9b8cd3cde40a7a6186385f2b1d6a18210e81fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
275e4605be856833cca0a8517434ce28

SHA1
11631e756dd1c8834195a6091ea30dd7fed97ffc

SHA256
59b8cb0b5fa5a98e0625507a2005463d738cfdd6603743dda40a498592f899bb

SHA512
1270edda055054f4d259943a2492bdaa6957228b05c234b4a22b11b95067ad07bb2b61ae69ddbb478a6e668ab6583a00f7f188859efa3a229b6553f6b508572d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
4268cde0f6e0958a42a9c70c91e53507

SHA1
b0a0f4f3ae6ff79343d7071ba3bcfd30aa2f8faf

SHA256
af40506e9795cc4ad2e6c6884f878685885e4b18053323184d76c7ac1720c8d2

SHA512
1b77623d6147a529eb8e574535e3cdc5ae6b439d78beec7e4758dbc75f7a233f4cd26e3e07bd0a8b2a6e59c23935223153efb9cd7ffa22adfad48742f85180f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ea7f146c5b31bc3f9fa4f25c91c07321

SHA1
f8d652219b80ea1b71bb3b6a9e63f99bcc2d33d6

SHA256
60a7fd628fc0b1a5e159695c76a6f11399ca55aac4913fddd9747a8bff8e41da

SHA512
0529013d042993a683d2e17927297d564c81c8bd0f14b3af5aa8c930681f2c2be7869688dab41a5a869e513dbc6e01b1c75b547fef1bb535d31e2a5ad267258f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c5828792-b5b5-4729-b995-39820e4168fc.tmp

Filesize
7KB

MD5
873fdc3287b24a0e90ea077525f3213b

SHA1
1eac459a4bc992d324cc254c7d2c5bc2fa12c312

SHA256
1c45df2a4dec3b09108f1f692c8496d6ac55dd41182ae877825cf11843783d4c

SHA512
64aebdb8d13922e8cddc3f52bf2b22e00d7e6e63a62fb894f5b1b6286ddcfff3a2ca9873d14dae626dd7817f1eba33c50034c220e4f07d098e1165b1a302440c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
168KB

MD5
91d1ebc259e392e9020542b4789af672

SHA1
41112d51937f52988617f4a5e90f4e2e731c1b16

SHA256
d993b3ee97d88933cc93df806492a7e48942b716ec1234758bf5f9124a9360e1

SHA512
3109a8f590c753dbb82c1beb04b17aa8070e53264f90f41b91a01d66bd7bb4814727f84079510dc42b7302957bc3c1533f88256a5d54e3c75936590bd3d0276e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
3401038f638d9f8f3ff8d6cb9bec20ad

SHA1
5fffdecb2c3024dab2691197916cfc9857a4d8e7

SHA256
8a05398812fcce61341b666db9342873e9d3dda85d412d34fbe0d4ada810a105

SHA512
30b3b8ec29cd800428f351f721c10f0d5a890d06eb810e25f27641880549d00c1ee91a271e8eec5b64eac07bde524e4430ae18880573d5f932affb5e92d31dca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
79f4d520efc5bc7755d7384115575816

SHA1
3f04cd8388f65ab261ac5cb89f94bc90fdce8d1e

SHA256
02ec62c9dcf156ef5cfc85995469a54f5c3bdbac5a8b71cc281ff693c203dec6

SHA512
0632c21f31474ff30e7bd60a4ea333bfde5ca6b014f5748b21d8cfba621c7a27604a77f750f271756696556cf7ea0a8e3b3e485990d4adb3643c9553b3447d55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
4710f62cae6afeb06a7707d6f71371cf

SHA1
d9c54f5175f4dc8b17e09d88689db2d508615d5c

SHA256
d5246f0a7af9c5f68d6ef43356e68be6a2bca380273341b33ca60ba4be77b253

SHA512
aa88d2d3a406c728a4b1cb5a06aa359080c91f53d8641c77ba0db197d539e022decb2c32b40e10e6ee25e1050d6694a822bfd2a8f1611c62cb00f96d6b1039cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
146KB

MD5
80fdd3cb20230a282cbb9674e1c3b138

SHA1
d53bd744a477d1bc301fe30eec3df8066d23c714

SHA256
b28bd051b9520def42d87aa3a684721a0760a08d08c724768e94c34a73d46cfa

SHA512
493ab4aeec29006064fea24b1c002c32eba1a08b2378d71529e002849b64f64bb5aeb3feb73d711d8a5112317d5e57c2ad945735ec5eb83e50f5f55d2afd2b73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
04f4a3bdee4fbb6eafd49bc1a8863478

SHA1
65864e1b0f54a21c5c3097166b71444759bcd5d5

SHA256
6f2635f08fe90c4a6ae63826aee250a214ad68ed9b386f437be544cbf9d030c5

SHA512
8f3dca9b06143b29ecc84ab999bf7f5842e9b30300d1c60dcee2ebb690e31df5e43fc35284eb8ae9bce5bc240ad64786cb7ecb44109e3aadb042365992c688e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
7426530737c161582de5c23338e827ce

SHA1
e282f03363fa38ec1a6f5b5f4ac4111816cda869

SHA256
25c46b5c5ebd312584b18622b164ca3fc7b2a41313c7439bea394fe32a028cbe

SHA512
f746bf926d262b11c48304f40038593566c4c957de47c57e943172ed579ed667bbdf20585b3b23dd5992ac953e57f179e8212e9db9242d974f97a02580172685

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d726.TMP

Filesize
93KB

MD5
ec2f09caae4d646941a7c32725daca11

SHA1
d9daf8ac0f7c17c38ca9c1b5fc9b90204cb69a2e

SHA256
32c49092f1f25c959cf595f5279f80a1501fd7ae1ec26f625dc045d0bdab5a1c

SHA512
ca951acb8d10ebf71dc45cd97f6e08a91afff3f56360b6d83bdf4ccb45b6f4f3cf8c838a1d99ebc1f77d383ed9b47740b57fac0a0424972d4a5a7207f058b800

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
7c94c9cb8a489ee582323f8e77972ebb

SHA1
c4fa8eb0d23aa4a7a06c5fe9e7b447246a53122c

SHA256
3d68b293891e39bda7e39d5a03b62c5c54e01721d4d892c81561ab06370c3ae0

SHA512
4bcad4fba975228d8c637ca22c0ed41675cb4bd7895d012b8cd579f2e10f9e1df2ef82d7570e0401d4d1ed5f5a02649269815acbfb618b0e180e875d6b2735e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Filesize
425B

MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\21e2e7e5

Filesize
774KB

MD5
e331b855ec583ac98c186c0875f240a0

SHA1
42f89af5847ad31a1d854bc2876b66d5ded532c6

SHA256
8257c0015155da4a391f22918fc8247b8c0536882c0b713c19e2ec57dc59b506

SHA512
a353f2385064f6f1c643758faf17fdb65736ef6e642599179ab1316b90a4d928387eb0ae3e7e3d58cb226920743437044bc8a4d210c0125f614bf373a175edb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\85222182

Filesize
774KB

MD5
24299d350f2828eb7f4e813e2330da2b

SHA1
391edbbdc477d23e3ae0508bd075d4ec870dd622

SHA256
d86d067c6561f8cf266ab068b06bf403334cb3ca017cf31142fe248246e82510

SHA512
f907a9a14d4ec07b0c02bd02395370bcb937ec40363239726c5af6b2111e552820c25676094e2eb65d1556a360f1256360b21fd6c1eba464526a02ecd7e8ee23

Download Submit
C:\Users\Admin\AppData\Local\Temp\86e84543

Filesize
774KB

MD5
a3f2c6d1741d45d988f0f5112db5f131

SHA1
8267cfaabf00a99c7b525ec64493e738564ea859

SHA256
5f5781ef5f4c55e221a2eb0d885172422ba7da9213f611289f2c9c841f74f306

SHA512
03481d2e6cd7ef390815bf47db41832c001a18e557b448c6205eeb2432dc5887045716c10300f1f10eccaf01b59f03214ad2b685a1d987634597cbe4af41b712

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yf5542cj.w3z.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dc2924d1

Filesize
774KB

MD5
f7ccc801e7ed918d2981dabcce9a8061

SHA1
a2e76a0ca30b3aa2411d7b5a63b1464868df4b4f

SHA256
373cd129471c3232bd7120dbf49aede1165717d0041a62ec764344ec4a10b507

SHA512
04a650bf139fa839a6b35b65fac0087d12aa69a83d1429e517eedf9ec85fea709978e27b58eaa3f3e9af450410e99b0feb7a547661154dfc805f053021a4824d

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\aigret.eps

Filesize
650KB

MD5
b16a26aee27cdc91b7f545e03877f9c0

SHA1
7eb68256ac0a97e4ee0ddc1db648968987406910

SHA256
b3abdc2b792cb4b0160bdcc291dcb13b31078d852bd20ae01ae0908a0b46b72f

SHA512
25b8a3155c9b30df90b64690b8f4d16b1de1dd321efe05f9c8e5e939e0884acd2e4cf07797dc7f1a87600793246640ef6e5ff3b2a82229406cce674fef15b446

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\barrette.accdb

Filesize
17KB

MD5
3de728173727b206fe14724ba05a28c2

SHA1
407ca05387c9fc1ac22cd409df1f0899d49a7cde

SHA256
f923b85549cf4d2f87c11f4cdeb5abb408974aea8235aa68acc849736ebdde28

SHA512
33b6e43f6bdaf31b7387ffa683e9581afb4d9b170767e6c6a51180608568db9675fb16643ff462dfd53c6ca76789902553d9bb6e834734fbd8ce4f8726b76206

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\madbasic_.bpl

Filesize
210KB

MD5
e03a0056e75d3a5707ba199bc2ea701f

SHA1
bf40ab316e65eb17a58e70a3f0ca8426f44f5bef

SHA256
7826395127e791a883359ea81308174700da0af8052cc9853b19fd29c2e4badb

SHA512
b0a3cfb6b34832f048fe0fc70c6fa76ae16a2cacda930f6529a83a967d6e8de1c69b93e0de3dc2126c5385d85e814687e695a0a4131399a69633141cad98da2a

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\maddisAsm_.bpl

Filesize
63KB

MD5
ef3b47b2ea3884914c13c778ff29eb5b

SHA1
dc2b1fa7c7547d8f1ad3f20f9060f7bc686118e0

SHA256
475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87

SHA512
9648d951d8d3640436c8029fd0f06786f7ff8f52191cd6959569c87868bb6c40ac8c7e495c09377a8a5c85e8d3942551c37eb84e916b5c16327d8d43a167820e

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\madexcept_.bpl

Filesize
436KB

MD5
98e59596edd9b888d906c5409e515803

SHA1
b79d73967a2df21d00740bc77ccebda061b44ab6

SHA256
a6ca13af74a64e4ab5ebb2d12b757cecf1a683cb9cd0ae7906db1b4b2c8a90c0

SHA512
ba617227849d2eb3285395e2d1babfe01902be143144be895011f0389f1860d0d7f08c6bbc4d461384eba270f866cce3351f52af1dc9ef9719c677619de79e42

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\rtl120.bpl

Filesize
1.1MB

MD5
1681f93e11a7ed23612a55bcef7f1023

SHA1
9b378bbdb287ebd7596944bce36b6156caa9ff7d

SHA256
7ed5369fcf0283ea18974c43dbff80e6006b155b76da7c72fa9619eb03f54cef

SHA512
726e8f58648a6abaf1f2d5bebcf28c1d8320551a3b6e7eef0cf8d99f9ef941e30e7004c24c98e9b5e931a86128d26de7decba202390665a005e972dcbe87ab93

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\vcl120.bpl

Filesize
1.9MB

MD5
1384dcc24a52cf63786848c0ed4a4d1b

SHA1
ea63180c94ea2d0417ad1860128980dd18c922ef

SHA256
d19f51871484cc4a737196bdb048193ad73f7f6bd061ec813766516eba26e406

SHA512
d405911672e3ea7abcbc898d7b807b9bc1dcbf4f83663d70bd8adab075960cf3d904b2710adbdafbcbb99ba4a41b9a40c64b7171e845255a91a042871b1ce8a3

Download Submit
C:\Users\Admin\AppData\Roaming\apppower\vclx120.bpl

Filesize
222KB

MD5
3cb8f7606940c9b51c45ebaeb84af728

SHA1
7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b

SHA256
2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053

SHA512
7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f

Download Submit
C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01.zip.crdownload

Filesize
6.7MB

MD5
da0f823b67bc093b75d381f2a105ecb6

SHA1
11e82222f4070fbadc8c4c2f194ba65d9fa60ac5

SHA256
ed88b5c4a8be75f5da0400817a9514bdcb38e602aa3fe463d39cec523dcd3268

SHA512
3d2986bf2b9d6fc9c7251934f68eab8995dc33b1cf3886c2360afebdc2f9f35a088a2e0d92002a3c225a07095a5213677df78a4bf95ed77842d98a998b1e1016

Download Submit
C:\Windows\temp\alwvhb0y.inf

Filesize
12KB

MD5
bdfcaf3ebbd35863cd90fb057ebfe684

SHA1
98031d5eb63285428535e9f466b1afe763154637

SHA256
30f5adfa8ce2abc76285036627cb491f822270c8f5425d42a685db6319883026

SHA512
3e41ebe472084271af89eb5ec4f7b09bf44f40ad2e75d4c764d28b7a6cd3db4594cb545ed012c70b214b0337d5bbad8af5dbf3a3fba2c83cd1397af48bf201b8

Download Submit
memory/60-378-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/1696-303-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/1696-273-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/2032-443-0x000000006D430000-0x000000006D5AB000-memory.dmp

Filesize
1.5MB

Download
memory/2032-444-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/2204-417-0x0000000071E80000-0x0000000073203000-memory.dmp

Filesize
19.5MB

Download
memory/2492-395-0x0000000007FB0000-0x0000000008026000-memory.dmp

Filesize
472KB

Download
memory/2492-391-0x0000000007920000-0x0000000007C70000-memory.dmp

Filesize
3.3MB

Download
memory/2492-412-0x0000000008E30000-0x0000000008E52000-memory.dmp

Filesize
136KB

Download
memory/2492-411-0x0000000008DA0000-0x0000000008DBA000-memory.dmp

Filesize
104KB

Download
memory/2492-410-0x00000000090E0000-0x0000000009174000-memory.dmp

Filesize
592KB

Download
memory/2492-394-0x0000000007EE0000-0x0000000007F2B000-memory.dmp

Filesize
300KB

Download
memory/2492-387-0x0000000004490000-0x00000000044C6000-memory.dmp

Filesize
216KB

Download
memory/2492-388-0x0000000007050000-0x0000000007678000-memory.dmp

Filesize
6.2MB

Download
memory/2492-389-0x0000000006F10000-0x0000000006F32000-memory.dmp

Filesize
136KB

Download
memory/2492-390-0x0000000006FB0000-0x0000000007016000-memory.dmp

Filesize
408KB

Download
memory/2492-393-0x0000000007820000-0x000000000783C000-memory.dmp

Filesize
112KB

Download
memory/2800-297-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/2800-275-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/2800-276-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/2800-295-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/2800-296-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/2800-293-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/2800-298-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/2800-300-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/2800-301-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/3044-379-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/3080-345-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download
memory/3080-348-0x0000000004F90000-0x0000000005022000-memory.dmp

Filesize
584KB

Download
memory/3080-381-0x0000000005FB0000-0x0000000005FBC000-memory.dmp

Filesize
48KB

Download
memory/3080-373-0x0000000006060000-0x00000000060C6000-memory.dmp

Filesize
408KB

Download
memory/3080-372-0x0000000005FC0000-0x000000000605C000-memory.dmp

Filesize
624KB

Download
memory/3080-349-0x0000000004F50000-0x0000000004F5A000-memory.dmp

Filesize
40KB

Download
memory/3080-347-0x00000000052F0000-0x00000000057EE000-memory.dmp

Filesize
5.0MB

Download
memory/3080-306-0x0000000071E80000-0x0000000073203000-memory.dmp

Filesize
19.5MB

Download
memory/3736-425-0x000000006D430000-0x000000006D5AB000-memory.dmp

Filesize
1.5MB

Download
memory/3736-426-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/3736-475-0x000000006D430000-0x000000006D5AB000-memory.dmp

Filesize
1.5MB

Download
memory/3736-477-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/4020-461-0x000000006D430000-0x000000006D5AB000-memory.dmp

Filesize
1.5MB

Download
memory/4020-462-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/4088-421-0x0000000071E80000-0x0000000073203000-memory.dmp

Filesize
19.5MB

Download
memory/4228-360-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/4228-363-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/4228-328-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/4228-327-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/4252-375-0x0000000071E80000-0x0000000073203000-memory.dmp

Filesize
19.5MB

Download
memory/4576-352-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/4576-358-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/4576-357-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/4576-355-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/4576-354-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/4576-309-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/4576-353-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/4576-310-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/4576-350-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/5068-268-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/5068-267-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/5068-263-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/5068-271-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/5068-270-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/5068-254-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download
memory/5068-253-0x00000000734F0000-0x000000007366B000-memory.dmp

Filesize
1.5MB

Download
memory/5068-269-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/5068-266-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/5068-265-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/5096-304-0x00007FF80A7B0000-0x00007FF80A98B000-memory.dmp

Filesize
1.9MB

Download