hxxps://bitbucket[.]org/envioss/agosto/downloads/Notificacion[.]rar

Analysis

max time kernel
399s
max time network
390s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28/08/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bitbucket.org/envioss/agosto/downloads/Notificacion.rar

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	bitbucket.org
2	bitbucket.org
3	bitbucket.org

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	taskmgr.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "431676914"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b5b733e17df9da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000009b0367e1f3bfb7c3f5a6d1c3fc9dcf59cbb4a2f2577cb27ec001186284dd983f4306b274f85783fedbfee8ef1e5beb25ba3fbecfb37af3351a36	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "431649146"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1ef6f0e07df9da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 438e10e37df9da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0757b0fb7df9da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "431662358"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Notificacion.rar.fep3r0y.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
164	sdiagnhost.exe
164	sdiagnhost.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4220	OpenWith.exe
4272	7zG.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2104	MicrosoftEdgeCP.exe
2104	MicrosoftEdgeCP.exe
2104	MicrosoftEdgeCP.exe
2104	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeRestorePrivilege	4272	7zG.exe
Token: 35	4272	7zG.exe
Token: SeSecurityPrivilege	4272	7zG.exe
Token: SeSecurityPrivilege	4272	7zG.exe
Token: SeRestorePrivilege	3216	7zG.exe
Token: 35	3216	7zG.exe
Token: SeSecurityPrivilege	3216	7zG.exe
Token: SeSecurityPrivilege	3216	7zG.exe
Token: SeBackupPrivilege	3032	svchost.exe
Token: SeRestorePrivilege	3032	svchost.exe
Token: SeSecurityPrivilege	3032	svchost.exe
Token: SeTakeOwnershipPrivilege	3032	svchost.exe
Token: 35	3032	svchost.exe
Token: SeDebugPrivilege	164	sdiagnhost.exe
Token: SeDebugPrivilege	2472	taskmgr.exe
Token: SeSystemProfilePrivilege	2472	taskmgr.exe
Token: SeCreateGlobalPrivilege	2472	taskmgr.exe
Token: 33	2472	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2472	taskmgr.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4272	7zG.exe
4272	7zG.exe
3216	7zG.exe
4800	msdt.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe
2472	taskmgr.exe

Suspicious use of SetWindowsHookEx 55 IoCs

pid	Process
2384	MicrosoftEdge.exe
2104	MicrosoftEdgeCP.exe
924	MicrosoftEdgeCP.exe
2104	MicrosoftEdgeCP.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe
4220	OpenWith.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2856	2104	MicrosoftEdgeCP.exe	77
PID 2104 wrote to memory of 2856	2104	MicrosoftEdgeCP.exe	77
PID 2104 wrote to memory of 2856	2104	MicrosoftEdgeCP.exe	77
PID 2104 wrote to memory of 1844	2104	MicrosoftEdgeCP.exe	78
PID 2104 wrote to memory of 1844	2104	MicrosoftEdgeCP.exe	78
PID 2104 wrote to memory of 1844	2104	MicrosoftEdgeCP.exe	78
PID 4332 wrote to memory of 4800	4332	pcwrun.exe	87
PID 4332 wrote to memory of 4800	4332	pcwrun.exe	87
PID 164 wrote to memory of 4584	164	sdiagnhost.exe	91
PID 164 wrote to memory of 4584	164	sdiagnhost.exe	91
PID 4584 wrote to memory of 3612	4584	csc.exe	92
PID 4584 wrote to memory of 3612	4584	csc.exe	92
PID 164 wrote to memory of 3904	164	sdiagnhost.exe	93
PID 164 wrote to memory of 3904	164	sdiagnhost.exe	93
PID 3904 wrote to memory of 3216	3904	csc.exe	94
PID 3904 wrote to memory of 3216	3904	csc.exe	94
PID 164 wrote to memory of 4500	164	sdiagnhost.exe	96
PID 164 wrote to memory of 4500	164	sdiagnhost.exe	96
PID 4500 wrote to memory of 5064	4500	csc.exe	97
PID 4500 wrote to memory of 5064	4500	csc.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://bitbucket.org/envioss/agosto/downloads/Notificacion.rar"
1⤵
PID:1964

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:4468

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Notificacion\" -spe -an -ai#7zMap29153:86:7zEvent25405
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4272

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Notificacion\" -spe -an -ai#7zMap27277:86:7zEvent1503
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Users\Admin\Downloads\Notificacion\01Notificacion.exe" CompatTab
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\System32\msdt.exe
  C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW2061.xml /skip TRUE
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4800

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jvtsvkkc\jvtsvkkc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25C0.tmp" "c:\Users\Admin\AppData\Local\Temp\jvtsvkkc\CSCC7AC437E4544EFB9B91C62AB880531F.TMP"
    3⤵
    PID:3612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xrfwwflh\xrfwwflh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES263D.tmp" "c:\Users\Admin\AppData\Local\Temp\xrfwwflh\CSC6B0BC4EAE6C8420A9BC5BCD6AD9BA344.TMP"
    3⤵
    PID:3216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mw5mg122\mw5mg122.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29E6.tmp" "c:\Users\Admin\AppData\Local\Temp\mw5mg122\CSCF82EF65F1CE94A429D48C33FC94A90.TMP"
    3⤵
    PID:5064

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024082819.000\PCW.debugreport.xml

Filesize
3KB

MD5
73f1b2a2147d47808655d51b0286a1e9

SHA1
708f9b0714ac5c2ae0c40e2d557c0c68ede71daf

SHA256
bb06cf6775152081235fcea4ccbe6765309e56f1e25619c3509b4684050f5988

SHA512
3824edda355ca0d574dc42dd10ba6e719e7b9cfc9d7baabbd76d93d48a43f8f00cc9626fec6e449810a472f17c848e72587f971fdb9b8fe618b645d8d3d9dbf6

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024082819.000\ResultReport.xml

Filesize
1KB

MD5
ffb50edcda102c3ec8ec1ffc8b215737

SHA1
fb12030b8d018e49989af6b1015c58e9bdfec861

SHA256
eba3b55280e0c891d9bfff31ac51881d511a5f0256d557c786f8af867aa850d2

SHA512
0e893bf73da8192218002f12489e91f78d10a9bdc06024d02c137326ae5440fbbf984febdfc0839275a9d0e79535f2ea6caa839817c8ce2cad88ac281c3f3066

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024082819.000\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RWTB4C9B\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PQUWUY8A\Notificacion[1].rar

Filesize
7KB

MD5
4e475c469cc039076324ad40a98659f7

SHA1
2e01faf0df84a3c4be1e7de6e31b0c7796acdeb9

SHA256
19257e4746808df531dc777205f0dde290b2d9b25aeb79cbbdf3596417533757

SHA512
a1711e50b1d0e53b5d9f6bde86e004258e3f4b248019792c30a0314f012896f7d8fb655fe3a633a561117f540f8cb8fd8032e327cf4603f21c86e254c0c47d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCW2061.xml

Filesize
748B

MD5
4149d6de90dcfa2ff9773c065d4a58a5

SHA1
2da9a832660400abdb0dbbaac956a24d2155ed6b

SHA256
b70e07df4a1033cca4fbdc39f2bcfdc351ac3620c6cf027f55cd43fa37b44d51

SHA512
e3fe14211492cfa9847e0c57104ab05b9d21d59f76880b4b742e3786b7525bee606c6055df10b6db37d28f58529b2e76c5e94ccbb4eb8b3f5c979c2f713bc257

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES25C0.tmp

Filesize
1KB

MD5
a00f9cd14e2f46bd1e07e80bdec1cd66

SHA1
cd831cbd5b7dde89624047f8bdccf1a9fe7a43dc

SHA256
17618449db3b3e081a8fd00120a5b2a431ae01eb0f255b2257ebc521a78977c5

SHA512
2845b6b582a6c9844904d567073c90dc697a15f0c3a5601fd8216bad86622d68bf3ce3e258e4f7c7734c21645e7996fdf933e696f34e0ce9d89e8a116c1bec3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES263D.tmp

Filesize
1KB

MD5
6a8b0cfa48fa71e54f2d9d5abd881a22

SHA1
6893c602f1def9fb67dc96f2f52b45e57d74f4ef

SHA256
1e0385235400ea396433cf87f8e134bda1f65b4be3d05fc196c3c0dc552d9eea

SHA512
57da7053f504a3a688df3d2051f8f39a2a7c923e3ef33299a37b245ab7ee0a6788c5935289f1d2114719225c128b49e2e87f87da492d0fc68c323e3df821fe4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES29E6.tmp

Filesize
1KB

MD5
03e2207505fd83d0b16a47312a8ff85b

SHA1
4378e6cbde6cbb881e3dd552fe01f5d5c9baf4bc

SHA256
d8785218b6c31b1678cb6d210382949c2d3e641487beea919e58dcb8fd8ca3d4

SHA512
ab6c27f320ee239a7b3f65b29049b5e2710132fc843204a64dca942d50997cc6e2ecb350bc6a6f30d471cce79d582f6cedc5b7584096530bd5a191f378ced72b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qqa2soo2.eev.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jvtsvkkc\jvtsvkkc.dll

Filesize
5KB

MD5
6b07a7a54366e7d991271d88169b56a0

SHA1
4144a76cb6b2ae5b344d78c9d0e372cf1f9a38ec

SHA256
10bc7f1b3358ebd45eb329007199c79ec798496b668e1391e3fbe2feeb4d2087

SHA512
5438947e060b58c258e21f10f889b5bb04d5572a298392a067edef46553e1d09fc9cf94b2c3308f97ea0395e7552cb43266c44d4a92d5cd9eff560d3b4f08f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mw5mg122\mw5mg122.dll

Filesize
6KB

MD5
0b1906e91926396a8bf34e1117ca4cb4

SHA1
c6614dc6977b5f85b0175e51fbb5c39e29991792

SHA256
f938a6132f071461fa497650d2333a661c2b4936bbb093807e9a5ce7558a9495

SHA512
07d1b9164f38249fffb75416ddf6a1f8e8a7a4a4374ca02b4bd58c3159a032640a14e1c900b659d05470983b38486a46b430d514eeb042f168f1e20bf97b03d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\xrfwwflh\xrfwwflh.dll

Filesize
3KB

MD5
9a14e0ba80dfc5cd09559a7c59255747

SHA1
389f831f303215ef8ca29f452a61a04f2287e8ef

SHA256
4c96b367c5659d2770445cd3d25a676baf30aacfaee4a98e17cacb916dd0e969

SHA512
f9db15fd11b5cc398b5720c66618764f787aa82af1155656ebe84a3c9a7c70ee245b7f2d129edcca96c35a239028305f6d9b5490bb83e5a793647bd0711d02ce

Download Submit
C:\Users\Admin\Downloads\Notificacion.rar.fep3r0y.partial

Filesize
2.5MB

MD5
20c1965c6662bd1cb827d059f21b0c1f

SHA1
c73ed51cb4d7e3d7feabe2f50946efea07bf3fa9

SHA256
4d785041f55b4072bda88ee79a5f4083dc69ec91fd16dcf6050e4f8ba934ed44

SHA512
a27116bb7a88552f742a4430876bee4c3b8f2c6418470821aef5d8989db8175d13bf93636b7d6f4385a323b29f86f2d2671f83a8716069fb3b5061e831d95571

Download Submit
C:\Windows\TEMP\SDIAG_773cb821-f515-4a3a-8c5e-6aea6f0121da\RS_ProgramCompatibilityWizard.ps1

Filesize
41KB

MD5
a49550a947238f4e23a81f8c765da712

SHA1
0c3daf73301d87c958d7f4f840bf060d87312d8d

SHA256
baf71bcc730ab740670653283eb97a6991af6d52bc82ad83dcc66e9ce9a9dd68

SHA512
3f0cb6e664bd7a998f81b783abaf37dc68ea55360ab021611c2336999b4b61bf6797ba9c427ad93b60c6382cb016c2f8474bc3fce0af85c823583be1d3013f02

Download Submit
C:\Windows\TEMP\SDIAG_773cb821-f515-4a3a-8c5e-6aea6f0121da\TS_ProgramCompatibilityWizard.ps1

Filesize
16KB

MD5
2c245de268793272c235165679bf2a22

SHA1
5f31f80468f992b84e491c9ac752f7ac286e3175

SHA256
4a6e9f400c72abc5b00d8b67ea36c06e3bc43ba9468fe748aebd704947ba66a0

SHA512
aaecb935c9b4c27021977f211441ff76c71ba9740035ec439e9477ae707109ca5247ea776e2e65159dcc500b0b4324f3733e1dfb05cef10a39bb11776f74f03c

Download Submit
C:\Windows\TEMP\SDIAG_773cb821-f515-4a3a-8c5e-6aea6f0121da\en-US\CL_LocalizationData.psd1

Filesize
6KB

MD5
5202c2aaa0bbfbcbdc51e271e059b066

SHA1
3f6a9ffb0455edc6a7e4170b54def16fd6e09a28

SHA256
7fd5c0595d76d6dec1fcbace5bbcd8ff531d5acf97e53234c0008ff5a89d20e2

SHA512
77500b97fcd6fe985962f8430f97627fedcf5af72d73d5e2b03e130bca1b6b552971b569be5fca5c9ece75ab92c2e4be416d67a0f24d3830d9579e5f96103ac9

Download Submit
C:\Windows\Temp\SDIAG_773cb821-f515-4a3a-8c5e-6aea6f0121da\DiagPackage.dll

Filesize
65KB

MD5
e99b38cf7f4a92fc8b1075f5d573049d

SHA1
406004e7acd41b3a10daae89f886ef8b13b27c32

SHA256
812ebb05968818932d82e79422f6fd6c510fd1b14d20634e339c61faeb24b142

SHA512
5637e6e949c24dca3b607b4f8b5745e0bb557e746fc17eff1274af36d52d5d7576723f4cd055fcf8fcf9fd267254e6d7fbb53cc173a15d3dfd3cce2015ac757d

Download Submit
C:\Windows\Temp\SDIAG_773cb821-f515-4a3a-8c5e-6aea6f0121da\en-US\DiagPackage.dll.mui

Filesize
11KB

MD5
65e3646b166a1d5ab26f3ac69f3bf020

SHA1
4ef5e7d7e6b3571fc83622ee44102b2c3da937ff

SHA256
96425923a54215ca9cdbe488696be56e67980829913edb8b4c8205db0ba33760

SHA512
a3782bfa3baf4c8151883fe49a184f4b2cba77c215921b6ce334048aee721b5949e8832438a7a0d65df6b3cbd6a8232ab17a7ad293c5e48b04c29683b34ecee2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jvtsvkkc\CSCC7AC437E4544EFB9B91C62AB880531F.TMP

Filesize
652B

MD5
0a09b26cabfdc8afc00df357a21c6274

SHA1
a1c824aad703ed1c3fb97144dee25dbfbea632ca

SHA256
e9ab4bff98d81b76be4851a235a85f8163c97a6fbbbd197670144a960b09638e

SHA512
aa8c483ec06efefac43c11fa27b781a0fb50c0ad82861495929527abe8afd8226db79421277c9d7d98ce810201dd02dec986c4c11d916650f17e5060215fe64f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jvtsvkkc\jvtsvkkc.0.cs

Filesize
5KB

MD5
26294ce6366662ebde6319c51362d56c

SHA1
c571c0ffa13e644eed87523cbd445f4afb1983d1

SHA256
685699daafafa281093b5c368c4d92715949fc300b182d234e800e613be5d8dc

SHA512
bc91bb591368bc511ca5169b3c23cd69a163eeb77f0d7a083fe09cc6aa15d7044a24f95811fa1518f44368dffda6d346f44e1568e7a5373a6450a63ae31883ee

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jvtsvkkc\jvtsvkkc.cmdline

Filesize
356B

MD5
7fa55e82cdde6f46449291c1fcb8ee76

SHA1
6502f87cc85cff498af4e1fdc0cff24f03f9421a

SHA256
27f3374df658c819e58f0b007f11ed95ad4736dc2cb96789948d69479e99dabf

SHA512
411e534d3a1dad19cc196e7f4d7717bfb468225f5941df7f4c0508edb1cf362e2a85ee397bb96008efa4386e750a8aa9fdd02f5cfe50971ce6421881ec78253f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mw5mg122\CSCF82EF65F1CE94A429D48C33FC94A90.TMP

Filesize
652B

MD5
cecef6b9bba52cfc4fc7b6bbfb100627

SHA1
00e0a717dc4c0961590872f7c38db3b94c58721c

SHA256
3d8f561788c54177ab6588b5d60517b8b2d698687a6ae01219e1ffcf16ffaa70

SHA512
4424e6945557253b9ec97e7d3c8612c012f870e951e2bc324ca0c514008b76dfe82d4e45ce9e19258ac5d774b9f5d1caffc9648a8fd4350d8d7b9bdfccab9718

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mw5mg122\mw5mg122.0.cs

Filesize
7KB

MD5
a6a5eb65b434fd6612543820a3e623f0

SHA1
a2034ad0126c821a52d46d7c8289f136bde963c7

SHA256
5e06c62640983f93e9ec11fecd221c238f537cf110f03a61049a25eb6030c02c

SHA512
0bcd9e7662731750f90510fa9f3f83afaa688636f0e312343ed05b420e4d3311d25b08370a705e2e43b0b4619541e0af9f213b27845b4e95155180ecf989d483

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mw5mg122\mw5mg122.cmdline

Filesize
356B

MD5
59c57fd636b2775707dff4cedba0c307

SHA1
ed51e3ef12e005c73db39ce402b01723b4136233

SHA256
19ffc77e30a316eb3bff2d0ee059e7fa6d856e1695857a1e5c733f342351e202

SHA512
5891c77ffb6dfe13196a52864ef3f13e6bf9bac86d069183b806df8bdb515c7105094f8ad0974ae566a11bddc1d2abfef5482598f28f714786753f00c6e2a1d9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xrfwwflh\CSC6B0BC4EAE6C8420A9BC5BCD6AD9BA344.TMP

Filesize
652B

MD5
6985bce892157b4391cf02cdc9b635ed

SHA1
091921e45dd04c4a49b21e8b85c0fed981c1a7ed

SHA256
516a90e7b9669d99b4ebacd1e3dd8c82a33f9f07fe861c914a7842ff9d260045

SHA512
8edd74fdbfe3b557b4010ecde7257a9ac41b3b2ddd5e26af7b2125d676bfc03b4a1ed22c43b4d3488fccb08e263e28062afaffe2276bcd928a10cb6543a44fa8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xrfwwflh\xrfwwflh.0.cs

Filesize
791B

MD5
3880de647b10555a534f34d5071fe461

SHA1
38b108ee6ea0f177b5dd52343e2ed74ca6134ca1

SHA256
f73390c091cd7e45dac07c22b26bf667054eacda31119513505390529744e15e

SHA512
2bf0a33982ade10ad49b368d313866677bca13074cd988e193b54ab0e1f507116d8218603b62b4e0561f481e8e7e72bdcda31259894552f1e3677627c12a9969

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xrfwwflh\xrfwwflh.cmdline

Filesize
356B

MD5
cdf83b22a2da212f6575b35d7e16a034

SHA1
a7db309af417e5039af4fcf87020c2d44b33b5ee

SHA256
f17bd71029484ab23a991f81e28e926d134d75c42c3a688c48dd106709c51de2

SHA512
9ec94d97ce83a1a70462d6b85a8fad5196037f9b7f1e46190a63aade093978ab5316af0fa325f86bda608aac85410cf852e088b251b83b263508161c83a73a25

Download Submit
memory/164-329-0x000001FABA450000-0x000001FABA458000-memory.dmp

Filesize
32KB

Download
memory/164-315-0x000001FABA330000-0x000001FABA338000-memory.dmp

Filesize
32KB

Download
memory/164-282-0x000001FABA470000-0x000001FABA492000-memory.dmp

Filesize
136KB

Download
memory/164-365-0x000001FAD2D10000-0x000001FAD2D18000-memory.dmp

Filesize
32KB

Download
memory/164-285-0x000001FAD28F0000-0x000001FAD2966000-memory.dmp

Filesize
472KB

Download
memory/924-43-0x0000018951500000-0x0000018951600000-memory.dmp

Filesize
1024KB

Download
memory/1844-88-0x000002B1C8300000-0x000002B1C8400000-memory.dmp

Filesize
1024KB

Download
memory/2384-0-0x000001EDFFE20000-0x000001EDFFE30000-memory.dmp

Filesize
64KB

Download
memory/2384-129-0x000001ED88E30000-0x000001ED88E31000-memory.dmp

Filesize
4KB

Download
memory/2384-130-0x000001ED88E40000-0x000001ED88E41000-memory.dmp

Filesize
4KB

Download
memory/2384-35-0x000001ED85E60000-0x000001ED85E62000-memory.dmp

Filesize
8KB

Download
memory/2384-16-0x000001ED81C00000-0x000001ED81C10000-memory.dmp

Filesize
64KB

Download
memory/2856-70-0x00000147C61E0000-0x00000147C62E0000-memory.dmp

Filesize
1024KB

Download
memory/2856-77-0x00000147D63C0000-0x00000147D63C2000-memory.dmp

Filesize
8KB

Download
memory/2856-79-0x00000147D63E0000-0x00000147D63E2000-memory.dmp

Filesize
8KB

Download
memory/2856-74-0x00000147D6390000-0x00000147D6392000-memory.dmp

Filesize
8KB

Download