asyncrat | hxxps://www[.]dropbox[.]com/scl/fi/z1qz063h96sx1ncitqdvr/01-CITACION-DEMANDA-JUZGADO-PENAL-01-DEL-CIRCUITO-ESPECIALIZADO[.]zip?rlkey=ccq9lbeig2e6e2615xi477l25&st=yawqudze&dl=1

Analysis

max time kernel
186s
max time network
190s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
29-07-2024 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/z1qz063h96sx1ncitqdvr/01-CITACION-DEMANDA-JUZGADO-PENAL-01-DEL-CIRCUITO-ESPECIALIZADO.zip?rlkey=ccq9lbeig2e6e2615xi477l25&st=yawqudze&dl=1

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

juanjuan20231.kozow.com:2107

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3556 set thread context of 3312	3556	01 CITACION DEMANDA..exe	102
PID 3312 set thread context of 1288	3312	cmd.exe	118
PID 428 set thread context of 3200	428	01 CITACION DEMANDA..exe	124

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 CITACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 CITACION DEMANDA..exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "5"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-95457810-830748662-4054918673-1000\{1111B90A-EB61-4A4E-A03B-6520A3A579C7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe

NTFS ADS 17 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\keRemote\rtl120.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\vcl120.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\maddisAsm_.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\madbasic_.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\madexcept_.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\maddisAsm_.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\madexcept_.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\rtl120.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\barrette.accdb\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\vclx120.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\aigret.eps\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File opened for modification	C:\Users\Admin\Downloads\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\barrette.accdb\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\vcl120.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\madbasic_.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\aigret.eps\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe
File created	C:\Users\Admin\AppData\Roaming\keRemote\vclx120.bpl\:Zone.Identifier:$DATA	01 CITACION DEMANDA..exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
3700	msedge.exe
3700	msedge.exe
3384	msedge.exe
3384	msedge.exe
4700	identity_helper.exe
4700	identity_helper.exe
4600	msedge.exe
4600	msedge.exe
3556	01 CITACION DEMANDA..exe
3556	01 CITACION DEMANDA..exe
3556	01 CITACION DEMANDA..exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
3312	cmd.exe
2240	msedge.exe
2240	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1120	msedge.exe
1120	msedge.exe
3928	msedge.exe
3928	msedge.exe
1288	MSBuild.exe
1288	MSBuild.exe
428	01 CITACION DEMANDA..exe
428	01 CITACION DEMANDA..exe
428	01 CITACION DEMANDA..exe
3200	cmd.exe
3200	cmd.exe
3200	cmd.exe
3200	cmd.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3556	01 CITACION DEMANDA..exe
3312	cmd.exe
3312	cmd.exe
428	01 CITACION DEMANDA..exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	MSBuild.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	MiniSearchHost.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
1120	msedge.exe
1288	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 1836	3700	msedge.exe	78
PID 3700 wrote to memory of 1836	3700	msedge.exe	78
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 5112	3700	msedge.exe	79
PID 3700 wrote to memory of 4744	3700	msedge.exe	80
PID 3700 wrote to memory of 4744	3700	msedge.exe	80
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81
PID 3700 wrote to memory of 5056	3700	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/scl/fi/z1qz063h96sx1ncitqdvr/01-CITACION-DEMANDA-JUZGADO-PENAL-01-DEL-CIRCUITO-ESPECIALIZADO.zip?rlkey=ccq9lbeig2e6e2615xi477l25&st=yawqudze&dl=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc74013cb8,0x7ffc74013cc8,0x7ffc74013cd8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15459723193987725261,10840041163504626903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2272

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2896

C:\Users\Admin\Downloads\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01 CITACION DEMANDA..exe
"C:\Users\Admin\Downloads\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01 CITACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1288

C:\Users\Admin\Downloads\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01 CITACION DEMANDA..exe
"C:\Users\Admin\Downloads\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO\01 CITACION DEMANDA..exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc52695a78aa4e8734d73b7446ba59d1

SHA1
15dfb5759ff566206ebd6b8a864e9e43182d7f44

SHA256
fc18d4b0cbcbb89e7f9cbe630c18c94ddecf8b59e74718cc5ad1f66fe638cf9e

SHA512
dbddeb1e9678141910933db917260164cfd07d5f2fcf3c7e82fc2c6db486be7dc47fb193a676e7a23d4ad6936c946ede8def1c555332e41a829d94c207cbfd51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce971e4ab1f7a51b5b9def5887018d15

SHA1
2f280b61a4c3297a3129d59b84ae971e90fdf9d9

SHA256
12e7606eaa7e67b697c8b098266fcb8cb066cd9f8f60ce43ba8405102a63af1b

SHA512
5358fb373e7ef29ac278c33161fbd06b4ac59b24be16e4c34f37ae88383655a182e30fa71cb7881cffc3af5ab055aad25d57f53f3114e6d79b946dbfaa228594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6421818faa1ce984ba15d2cc6bfd35f0

SHA1
29a1cae00ba37f55aff0f00f7623dd1d1272e373

SHA256
3d68711f54240bc70cdd69582d8b1b940c241f9b1c82b218bee2f4f33c04c286

SHA512
98e4ef6ae8eab5b374fe69205e22f3fd78fbd643b9a8f5d443d4ed9bfcd3aabdd0182af35d423857003a75cb204ee9db3680485d6c4614ecb955d78705cb1563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
50efaa6be305c118b9c9f64bec72e9ac

SHA1
be56b35b885385a4545cb8021fdac92ae3ab0d71

SHA256
525f45c145c5b4e87be1534245fd8a06e64c2c60519ad0db159d47b57d44ba01

SHA512
19a159d20f3c4b4f02806ab9fc126c0747f4ca410fae5c7a65b205e92d88bca4839b42f1c8d330cc876384867fd506c018bad4ed2c9e63debaa20f7649b8ee52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
295B

MD5
021faebbc56202f91049245f2b213717

SHA1
cc64f5820481102b7bbdf0287ed6674cc679ca11

SHA256
916ea9920133caf62dbc461c2b00076d2a484b3c2728440bbf8d221d5e3e587e

SHA512
192f615cc9d39cd895d3bc6cbbad2ad2f25e33a45b3c06a6be0fa9bf3cd98e4f38b8232f53aefd36e434b892b113eb07945045f0bcda29383455d037c60d84c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e4486475434361e0541e7927035a6de

SHA1
555098767570c20c85d8e2ae70e3f73bd7473419

SHA256
c17b29e0208df9daf7d410b1317805f3ac6abac900838fec8623f00ba22f6f07

SHA512
179a6710fa91ecd52bf21bde51312af61f6beadad01e599afddab22a0d37bf71d04c79f59fab28268d239bede7f793ee2617f5a36bea87d9721068cf7e5b520f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79102f4b58356acfd29b526976609a14

SHA1
f149dc6d97385a3e5474b48f1a9ff51c82cf6ca2

SHA256
7b1e0ab5a44bcae734ba7df93d2a9ddb48f6e84f20156fda3abe699c008b6962

SHA512
58d67cd0f7c2b044f685dad8df66d946a43072c603cc658a82b59407d11cd04e5e7a9daace30965781cebae8039db6affb8cb6514df5ce9408ef95500e829420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e44b58f978828472d70f7e690de149c9

SHA1
9603f84ff50caea13f43a90a53bd01e8a0cdb079

SHA256
66bd6833009708882ebee100b323fa1fb234161227565a0b98d6bd8e44eb7897

SHA512
5fb4ad0bcbeafeefb1834b41f044b7a0b183eb65c73995e5085ba954c8433734d170663b3fc4045c214c8e9140765788b874f0dbdcad93225f840bc0eaafb195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b145107ac9059092147dac7394ea02a6

SHA1
5e47c92b8f779d4466a452b3458dd669cae095ee

SHA256
fbc16aa059c6b9e0a4d53ba303b5866cf6a44054376381b96062e42d1f71a629

SHA512
175f998328f59f2f9f7956216796b66860b0da5c262657a1cd8aba00b0353d4579416ce946e07922fd59c52a7c3a4f1b321f057546d57f95bd8d896f0cfc36c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ef053baa123374090295a8a42e627f3

SHA1
5feffef7237be957cc04bb340816e67aa59c99c6

SHA256
36e358801ce4ffd2c5537ec89145c202382c0b0d05ba7e40429e3ef560c49306

SHA512
9d46bfef0ffb69c20991a2ed4af0d16f900d3c9ea9850b2dcc241a4312dd0595fdfe023bcb427fbe7e93c56f2be4dc366d64be30f1bbdd963fc1a0b08fe0f6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e45471bc8c4e89f6b7924490b851fcb0

SHA1
bd3cab4f2c31de4ca29433a4d0f7e31387d7ef15

SHA256
5d9c44b9afa641162a5d35832ea23b583d255163bb7ee4234292edc36565c78f

SHA512
6972866bc84ad431fc0b40ede7e340efbecb70a5497b8aefa5505c945d71f5bfc7977d3a38cbe1c0c7c15f84af428d275ac9727ed912001901065e06488d9d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a943610674f9328a12f37d3e532861c4

SHA1
1703b1a58640e195acb148f38f0f58d42ef20256

SHA256
54d110c119df5e1a7e23eed966303480ee59faf9566f35cd3e09acc4abdb6f0d

SHA512
def4ef0f5a750fd032ad2fec8914c0026f1c2e469bf8148dffee1ed64658e2a8c1c6efe189ec33e695ebe748f07084d213eea315a1479acb58d447e77d32fced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
cde86bb0882ad499002e38f09220259b

SHA1
2733fc34857558a98bc22d84ec7c54fdc69d8a30

SHA256
da3b23fa6629f25b43cc1e817fc1bf555c2d0c659c48fc72305ae9f7382001de

SHA512
9f47b1876f9f34c557e5b4549fc00a33201341b454e609b03885bf5a21dbbb3a13a0952de6ac8103d787fcd114763c7e480069d4bc82adb6ff8625329fd1b6f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59aed4.TMP

Filesize
48B

MD5
2d3e319808c8ea5e423c7c68f690e696

SHA1
3410a0ebe4883661231b17c87e7fb736fc56f557

SHA256
59b29d01c6271d90a88bd47af79a7ccac08b1f2614b47dc2ce191e8e81f84cd2

SHA512
9e63e33666fb0b4abf3b201e13c9aa2c7f6794e55d6ff71b0eafb2186469ea7a98a538ccf19ed4668ca5f88584d0abe7a1518f1b104142424c97135c0231feea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
79b092e8f87b6c7293b18d150cbf860f

SHA1
eee8aa21724de6246d60b2b746348fb8bea5b0b1

SHA256
c94d27cf42fbf18935714f76161d8be0241ac9393086730f4ba511b7b9bf0a2a

SHA512
f505d8c323f4275eb74f36e50f31c696f195b6fb6c5a9ef792606c59bff9dda69a498e98edf4dc8969d7eb339dc7e8d8f3fa5f79ca50dd1954c620bb54ee79b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c751cf4d0f691aa3048f246af21602ad

SHA1
1d2b4aeb00a3342cd7135b2e025872087cad8695

SHA256
657c4ddd8a4825a68b25eb2fdd99d259ab1c4b455ddef88fc61256422c3afe46

SHA512
058efc936b28745e0949e17aeb81e6a29fcafb982f1cf12b4a6f277f5e4d5b5bbfd574f7fbcb27f63aa2ee76d1b8759e2cd816af27dd857d963731c14aa9334e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e8bdb9acc4763fd544f970ccebffdbb6

SHA1
8e10b7adc2c1d69e635f930c6cb6854c8eac61b2

SHA256
17788e471ec28b0e606a1fc8f35e98e06c3d15091962c9e2b6ee49d49dac9d37

SHA512
24d2757105b02efb015f55afa6e87d298dad5856aea57cf12300913f7550dc105360720000b3e6647dfb3e08c2ab4a46577af1f8c9eae2b81d0cefa8950d3217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f9001061398cca297dc42c67975f8de2

SHA1
80a8fa2c9307cf1591cc1f9bfff54e84d1992d7f

SHA256
bdfeb5fffc074101dcb99ec6aaa3d1c81fa1fdcb38000551988480ee10c91977

SHA512
c3676f00eda243aa6286f08251fff5df09515d0fbbf8e746a51548e46123068404be76f758328289e622eec0d69ad64408ba89aa115fd3cd01aaac774e5e7082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593d6d.TMP

Filesize
370B

MD5
a03088ae22301dfb3a85492d327fcebf

SHA1
8ab4ac38c0ccb28baacf919e388734d003574366

SHA256
9fb8035cba30e6596eed97c34eb48dabb9569c70a8f0aeb7c79ed4f024830a29

SHA512
c9ebc655a3d2cf4901a4c463ed7f38f00b3e80cb7eafaae683db011a9450453c3aa97b374007ec37792e2b2f5edc87ae1b47c652d9a06c6216f38e200351f704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49994ae1211bdc19508e1081bda745a9

SHA1
3694552d04b367039c6951c3029308fd7021b1fd

SHA256
bf73a9fae603356e6bdded7bfada8d8d215c976251f434e896594f5d7d079d77

SHA512
fcd95d9b37bd5da30677fd161f4e35f4260dc4e4a7716708c9d463133d91e9062df96ffb0028e87a4b8663456b314723f6ce4260fdfe85c769a59f388908b97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f395cd2933bcecd126d5957469e65176

SHA1
c296938a6b52362310331ea318c01d1f27369b2c

SHA256
b792ab165abe31477052a32670e946a5a4936a4aa17d7017ba250650a875dad6

SHA512
7d15f1a2452b02d706758b1b93aeb93d8fed635b3681d1cf05092b0a31d6ce2ea4d844b628ce81f53f935056d74c88b27dbeb1babca8382ce05f90903fb60e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d3a0fab2930cd7fc88145b578a74336b

SHA1
53501aef5f931563298c31938e9f163b1df14242

SHA256
8335f539043820678ae5524558542cd8c620c3f85e6de6e34da585d0a970bdd9

SHA512
7113401061539312ee52f9c55e31beb8e5f41aaf4b693826bcdebb4052674016c8ed4f4fc67285160a3f764efd1343cd8e33d6f26bd9788dd61f20bd91c62906

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
e94bd74837a5ae7199b785dafe73b2d1

SHA1
d9c0ca953a7ccdfcf7ffd2e1fa6cf91952a30f78

SHA256
7ec408ba0be314b7fd1ea8a6312eb5e2f0eaaef9623fcb9c6c875a555215bbf3

SHA512
f2185d4244b7e2ae96513f3415e3d0f1679c9eb6cf2cbab3f57aa3c8b6ed8fdc90a361d00f74902f86721c9ddbb706d5d9852fab905819213315a6855e72d699

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp

Filesize
10KB

MD5
21aa5cd409c26df0f9d85fd262f72f84

SHA1
64c02f42a4b598f8a85c507717f4f644324ae594

SHA256
f92207990cba274f6c7a3b8571ebc51bef3fd11369a8a83849379df39ada3f78

SHA512
84d2b7448dd50f2410ff0b0757e981b0d67e43a6e4b610a20479235f119d5a76b28319ce40df54ed79160bcc34deb6c150ecfd134ba0dd59947e871cfa2fce07

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b75144

Filesize
774KB

MD5
beb7d4ff13b1785eed362c021e106430

SHA1
99b409792ace015f492539f7c1c68c4701effde2

SHA256
41334a79552fa7d66f86f4148cbe4061e1f832469b839ddb3f5ba11470b2ba44

SHA512
ddbda72883114f6bb2d91bcffc28397805706c5aa8dfb2540f270afd80ca200556d05ffefe49ef8c769f5b3bd41b96e363986e2dcded8384d0c657c0f76df0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\d49620f

Filesize
774KB

MD5
dc1f19cd20e29db8fca211d729ece926

SHA1
5fa55d2ad36594c090095c092eef5f790456045f

SHA256
d811dcb458e1a482cc00765c6983ec3c4bb5c286abaca813b8d2d61fe9eacd35

SHA512
2e9e402e53ab644dcbd99d57f59b839251d650e3dfb24cd8d39e8e609b75483c8f1186ad941454ba964ca30465c78bbd81508a8e6831c5fe73ed9e4e597084cf

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\aigret.eps

Filesize
650KB

MD5
9be505b4fe19793b22ba30a2d0e6e055

SHA1
da13818abf2ea125a356e7eeec252f290b792054

SHA256
a404b35a7009c7f7e5c553f97e2bb0314173c3b3d1fb1d940dd21b0560f652cd

SHA512
cc40ed41fffde77b64985cc023044e979d7946cfd9433dfb0b7246094a0d463bad01d7b04f7eef3bf95511cfc8498dd7fa3025de31214e7c5fb52835dee174e0

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\barrette.accdb

Filesize
17KB

MD5
3de728173727b206fe14724ba05a28c2

SHA1
407ca05387c9fc1ac22cd409df1f0899d49a7cde

SHA256
f923b85549cf4d2f87c11f4cdeb5abb408974aea8235aa68acc849736ebdde28

SHA512
33b6e43f6bdaf31b7387ffa683e9581afb4d9b170767e6c6a51180608568db9675fb16643ff462dfd53c6ca76789902553d9bb6e834734fbd8ce4f8726b76206

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\madbasic_.bpl

Filesize
210KB

MD5
e03a0056e75d3a5707ba199bc2ea701f

SHA1
bf40ab316e65eb17a58e70a3f0ca8426f44f5bef

SHA256
7826395127e791a883359ea81308174700da0af8052cc9853b19fd29c2e4badb

SHA512
b0a3cfb6b34832f048fe0fc70c6fa76ae16a2cacda930f6529a83a967d6e8de1c69b93e0de3dc2126c5385d85e814687e695a0a4131399a69633141cad98da2a

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\maddisAsm_.bpl

Filesize
63KB

MD5
ef3b47b2ea3884914c13c778ff29eb5b

SHA1
dc2b1fa7c7547d8f1ad3f20f9060f7bc686118e0

SHA256
475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87

SHA512
9648d951d8d3640436c8029fd0f06786f7ff8f52191cd6959569c87868bb6c40ac8c7e495c09377a8a5c85e8d3942551c37eb84e916b5c16327d8d43a167820e

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\madexcept_.bpl

Filesize
436KB

MD5
98e59596edd9b888d906c5409e515803

SHA1
b79d73967a2df21d00740bc77ccebda061b44ab6

SHA256
a6ca13af74a64e4ab5ebb2d12b757cecf1a683cb9cd0ae7906db1b4b2c8a90c0

SHA512
ba617227849d2eb3285395e2d1babfe01902be143144be895011f0389f1860d0d7f08c6bbc4d461384eba270f866cce3351f52af1dc9ef9719c677619de79e42

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\rtl120.bpl

Filesize
1.1MB

MD5
1681f93e11a7ed23612a55bcef7f1023

SHA1
9b378bbdb287ebd7596944bce36b6156caa9ff7d

SHA256
7ed5369fcf0283ea18974c43dbff80e6006b155b76da7c72fa9619eb03f54cef

SHA512
726e8f58648a6abaf1f2d5bebcf28c1d8320551a3b6e7eef0cf8d99f9ef941e30e7004c24c98e9b5e931a86128d26de7decba202390665a005e972dcbe87ab93

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\rtl120.bpl:Zone.Identifier

Filesize
134B

MD5
2bdd545fee5b1a4b5f994ce2566f9a5c

SHA1
e3ccf9354c6b75cb1d3a5281c9a750abc553d0ed

SHA256
a32006cb7c25706b99641e332da848abea13e8106fbd6c24bdbc27883a018123

SHA512
841d18890f277934d8ec57f6bcc238b1da076fb80f377353c8744096c090a32eeb09803fccb047b32b803b7125d090258a9f65677ff8880d57f9e342d9c9f750

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\vcl120.bpl

Filesize
1.9MB

MD5
1384dcc24a52cf63786848c0ed4a4d1b

SHA1
ea63180c94ea2d0417ad1860128980dd18c922ef

SHA256
d19f51871484cc4a737196bdb048193ad73f7f6bd061ec813766516eba26e406

SHA512
d405911672e3ea7abcbc898d7b807b9bc1dcbf4f83663d70bd8adab075960cf3d904b2710adbdafbcbb99ba4a41b9a40c64b7171e845255a91a042871b1ce8a3

Download Submit
C:\Users\Admin\AppData\Roaming\keRemote\vclx120.bpl

Filesize
222KB

MD5
3cb8f7606940c9b51c45ebaeb84af728

SHA1
7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b

SHA256
2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053

SHA512
7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f

Download Submit
C:\Users\Admin\Downloads\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO.zip

Filesize
6.8MB

MD5
76d71e17cbe00229d75c59990ea6f68c

SHA1
50168020c85a040ed72d170fe1470e95a139775a

SHA256
7da5449d406c51fd976e62a5dd63e02207bab240fa82a1178119b0d2aa3fd86f

SHA512
17cbfdeb2f6a90d6ac4847c87cc80978c271ccf22e05c4d9136f5c06c768b6fbff3c9eed465b183756c09873e28bbeb1f3c7be6bfd712443fd3c9d72d8f041e1

Download Submit
C:\Users\Admin\Downloads\01-CITACION DEMANDA -JUZGADO PENAL 01 DEL CIRCUITO ESPECIALIZADO.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/428-691-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/428-685-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/428-690-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/428-688-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/428-687-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/428-686-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/428-639-0x000000006EF50000-0x000000006F0CD000-memory.dmp

Filesize
1.5MB

Download
memory/428-640-0x00007FFC82BC0000-0x00007FFC82DC9000-memory.dmp

Filesize
2.0MB

Download
memory/428-683-0x000000006EF50000-0x000000006F0CD000-memory.dmp

Filesize
1.5MB

Download
memory/1288-472-0x00000000730F0000-0x0000000074407000-memory.dmp

Filesize
19.1MB

Download
memory/1288-606-0x0000000005C00000-0x0000000005C0A000-memory.dmp

Filesize
40KB

Download
memory/1288-605-0x0000000005C20000-0x0000000005CB2000-memory.dmp

Filesize
584KB

Download
memory/1288-604-0x0000000005FF0000-0x0000000006596000-memory.dmp

Filesize
5.6MB

Download
memory/1288-585-0x0000000000FA0000-0x0000000000FB6000-memory.dmp

Filesize
88KB

Download
memory/3200-693-0x00007FFC82BC0000-0x00007FFC82DC9000-memory.dmp

Filesize
2.0MB

Download
memory/3312-449-0x0000000074700000-0x000000007487D000-memory.dmp

Filesize
1.5MB

Download
memory/3312-198-0x00007FFC82BC0000-0x00007FFC82DC9000-memory.dmp

Filesize
2.0MB

Download
memory/3556-185-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/3556-184-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/3556-187-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/3556-188-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/3556-189-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/3556-190-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/3556-182-0x0000000074700000-0x000000007487D000-memory.dmp

Filesize
1.5MB

Download
memory/3556-160-0x00007FFC82BC0000-0x00007FFC82DC9000-memory.dmp

Filesize
2.0MB

Download
memory/3556-159-0x0000000074700000-0x000000007487D000-memory.dmp

Filesize
1.5MB

Download
memory/3556-186-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download