Malware Analysis Report

2025-04-13 12:23

Sample ID 250320-gg86hsvtcy
Target JUSTIFICANTEPAGO.exe.zip
SHA256 99d51eb9f2f98ed2de0134b9624a06a7f6102b91dadb0525db661751aff44b7a
Tags
stealerium collection credential_access discovery persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

99d51eb9f2f98ed2de0134b9624a06a7f6102b91dadb0525db661751aff44b7a

Threat Level: Known bad

The file JUSTIFICANTEPAGO.exe.zip was found to be: Known bad.

Malicious Activity Summary

stealerium collection credential_access discovery persistence privilege_escalation spyware stealer

Stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess

Stealerium family

Uses browser remote debugging

Checks computer location settings

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Delays execution with timeout.exe

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Modifies data under HKEY_USERS

Enumerates system info in registry

Kills process with taskkill

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-20 05:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-20 05:47

Reported

2025-03-20 05:50

Platform

win7-20240903-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe

"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.total-procurement.com udp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 www.total-procurement.com tcp
US 172.245.136.70:443 tcp
US 172.245.136.70:443 tcp

Files

memory/2420-0-0x000007FEF4F63000-0x000007FEF4F64000-memory.dmp

memory/2420-1-0x0000000000E20000-0x0000000000E38000-memory.dmp

memory/2420-2-0x0000000000370000-0x000000000037E000-memory.dmp

memory/2420-3-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

memory/2420-4-0x000007FEF4F63000-0x000007FEF4F64000-memory.dmp

memory/2420-5-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-20 05:47

Reported

2025-03-20 05:50

Platform

win10v2004-20250314-en

Max time kernel

101s

Max time network

144s

Command Line

C:\Windows\Explorer.EXE

Signatures

Stealerium

stealer stealerium

Stealerium family

stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2560 created 3448 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Windows\Explorer.EXE

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2560 set thread context of 4016 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\SYSTEM32\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869233401458906" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2560 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe
PID 2560 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe
PID 2560 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe
PID 2560 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe
PID 2560 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe
PID 2560 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe
PID 4016 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4016 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 316 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 316 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4016 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Windows\SYSTEM32\cmd.exe
PID 4016 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe C:\Windows\SYSTEM32\cmd.exe
PID 920 wrote to memory of 3168 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\chcp.com
PID 920 wrote to memory of 3168 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\chcp.com
PID 920 wrote to memory of 5088 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 920 wrote to memory of 5088 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 920 wrote to memory of 2248 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\findstr.exe
PID 920 wrote to memory of 2248 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\findstr.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 1788 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2860 wrote to memory of 3172 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe

"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe"

C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe

"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE PAGO.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff81a63dcf8,0x7ff81a63dd04,0x7ff81a63dd10

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\findstr.exe

findstr All

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2012,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2004 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2172,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2168 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2308,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2304 /prefetch:8

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3016 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3096 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4084,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=4080 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4584,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=4580 /prefetch:1

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5184,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5180 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5364,i,4924111739376812218,2118158862916562540,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5176 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ff818e2f208,0x7ff818e2f214,0x7ff818e2f220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2176,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2224,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2580,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3516,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3552,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3524 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3460,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4324,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4332 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5032,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5168,i,5458620933130530748,3579210931969230281,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5160 /prefetch:8

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5c956969-f631-4266-8f89-966e97baf325.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4016

C:\Windows\system32\timeout.exe

timeout /T 2 /NOBREAK

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.total-procurement.com udp
US 172.245.136.70:443 www.total-procurement.com tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
GB 142.250.187.202:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com udp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.200.46:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 clients2.google.com udp
US 150.171.28.11:80 edge.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
GB 142.250.200.46:443 clients2.google.com tcp
US 204.79.197.239:443 edge.microsoft.com tcp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
GB 95.100.153.183:443 copilot.microsoft.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.187.225:443 clients2.googleusercontent.com tcp
GB 142.250.187.225:443 clients2.googleusercontent.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
GB 2.18.190.174:443 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com tcp
GB 2.18.190.103:443 assets.msn.com tcp
GB 2.18.190.103:443 assets.msn.com tcp
GB 2.18.190.103:443 assets.msn.com tcp
GB 2.18.190.103:443 assets.msn.com tcp
GB 2.18.190.103:443 assets.msn.com tcp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.bing.com udp
GB 95.100.153.143:443 www.bing.com tcp
GB 2.18.190.103:443 assets.msn.com tcp
US 150.171.28.10:443 c.bing.com tcp
IE 13.74.129.1:443 c.msn.com tcp
GB 95.100.153.157:443 www.bing.com tcp
GB 18.165.242.4:443 sb.scorecardresearch.com tcp
US 2.16.55.225:443 img-s-msn-com.akamaized.net tcp
GB 2.18.190.103:443 assets.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
GB 2.18.190.103:443 assets.msn.com udp
US 20.189.173.8:443 browser.events.data.msn.com tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
US 104.16.185.241:80 icanhazip.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 104.16.185.241:80 icanhazip.com tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/2560-0-0x00007FF81E503000-0x00007FF81E505000-memory.dmp

memory/2560-1-0x0000022AE3BE0000-0x0000022AE3BF8000-memory.dmp

memory/2560-2-0x0000022AE5770000-0x0000022AE577E000-memory.dmp

memory/2560-3-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-4-0x0000022AFE2E0000-0x0000022AFEAB4000-memory.dmp

memory/2560-8-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-5-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-12-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-14-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-16-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-26-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-32-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-38-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-48-0x00007FF81E503000-0x00007FF81E505000-memory.dmp

memory/2560-57-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-59-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-69-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-67-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-65-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-63-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-61-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-55-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-53-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-49-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-46-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-51-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-44-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-42-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-40-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-34-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-30-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-36-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-28-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-24-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-22-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-20-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-18-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-10-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-6-0x0000022AFE2E0000-0x0000022AFEAAE000-memory.dmp

memory/2560-89-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-1343-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-1344-0x0000022AFEAB0000-0x0000022AFF1DC000-memory.dmp

memory/2560-1345-0x0000022AFF1E0000-0x0000022AFF908000-memory.dmp

memory/2560-1346-0x0000022AE5870000-0x0000022AE58BC000-memory.dmp

memory/2560-1347-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-1348-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-1349-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-1350-0x0000022A810B0000-0x0000022A81104000-memory.dmp

memory/2560-1354-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-1357-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/4016-1358-0x0000000000400000-0x0000000000B0E000-memory.dmp

memory/2560-1359-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/2560-1360-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/4016-1361-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/4016-1362-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/4016-1363-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp

memory/4016-1368-0x000001A561EF0000-0x000001A561FA2000-memory.dmp

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\System\Process.txt

MD5 6095de51e6134e7f03bdcbe62b5e47ef
SHA1 6e0d468ec76d229e0e40d79f2500be4ebe9607dc
SHA256 b2edc406d2db971861588c6921a2b7d4e06ea9dc358eb75aba718aecf421fdd8
SHA512 f04af0d0af22e5b6bcd16c4d8c5f8fcef05ed185ef64cd66fdd5c0c8a95d5a150cc6db72e44ea72e0a61eeaee0167d2e375fb61f84c710d1d59a30c9319de35c

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\System\Process.txt

MD5 1b27989b642d3f2efeb050f66e4ad0f4
SHA1 0dda973dc35108c13b2f1212860b9fb692b47f78
SHA256 630e76488b435ada5e76f223858d89dee769bad7f3d578f5f051b5c66bc2ef58
SHA512 3594c374be27ebcba244cb35bfaf22bbcde658e57f6fce7b0090e548b031bae059309228508ecf75b46d4021bfeabfcae4bc0a35b6da474bb8cd2daa8bd06148

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 fc9c85d3b927696aed15cd8283dbd1c9
SHA1 ca368f0ac7a0311e31e9a718a47b829ab9ea5beb
SHA256 e83eb3565015f26dd35455d0d919eb22260a96e78dadfb3090ce3b385a9b2321
SHA512 f5c614f331f6c90eb283512e893c9f7d657d0a90f9733a095a98d8e35a5b224fa03b0b98e29203835392b30f7f892af6b7458dd96cbd5279c08a6af3ffa4f6bc

\??\pipe\crashpad_2860_WAKGVGZHHOMAHNTD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\System\Process.txt

MD5 b850528c4717cd48fd2bde353a6b8ff7
SHA1 3aa4a99829f42e4b1f2d6e533a33d8e9148c85df
SHA256 50396360be8a0b85ca4f08bb3e5f593cc156b61e06c17141060e7262af289587
SHA512 228bfea1fc7835dd1c975686baaea98d5d52444b08eb380756d2129e82d5855e8fa217b68142fccb2a75b258a6a456bf4459792a9cb5e909069aef3ac7777d48

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\System\Process.txt

MD5 dcdef3fd067a4dd0d4133443a66e3c24
SHA1 60d4c2830574498d9e7b883f9372e24b8a920815
SHA256 68c3c7ebcd21d4dbce36079d7dd3f7452e59bde72fdfa5f59e7776f533417ff0
SHA512 8d187ad7d2e536f622792fad6672943f5da8aa4199dd2df862e3e4bb08a9fe64a6777cb5153bf1912b0bb2266281855fe0782d8df61329883fdfc46cfcbab971

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\System\Process.txt

MD5 342dd3b73dab10c9676b39f8dec7eb99
SHA1 f5a1307e6e491858f36d83d01e627727606c4123
SHA256 ea6fce659b8243f6cbeb5a0376774ae8bd86f72f4bc7f2c8a5019f6fb822f912
SHA512 a6d3ff20f5c3c7cb25888355a5736639be6370282ce0569894066da6059aecfd4997e998f7c9a6bd8af57244a48fc281fdb3682a274f9c0b1824eaea0378a55c

memory/4016-1506-0x000001A563290000-0x000001A5632B2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8734b4a181214bb62f91cfa36c7e2c98
SHA1 9cff323f10778a23d73ac3dcffc038d3bf661b78
SHA256 e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5
SHA512 e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b3144c3e3ee88721e30c9937117ef831
SHA1 b2967762191961931f4c217e621b7d44444351d3
SHA256 8e97378b8c1f666607819fde8e6bffe5f1063e42603933183dac51af7270ec73
SHA512 9777fd7a34ab836b670616e64d4ddf4ce905c82a8aee7b5c87452df7899c3d7942fc17f8bcc3c3187adc5ed7dd65c474c14df40227226241e8fee7c7caf1ca17

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f34505cfbbf30cbc3705ca23d22e0df0
SHA1 2427e25c81c69a6ef7270932610c1546999be559
SHA256 f6051d57f8f7c513cd9f4afc6ae01b65983181af2f9f03d8cac60661ac8c5d54
SHA512 211e21f7faacc8a974120f28932416aaa2f19c793af2cd1f1626f7c67c8936e39608f5adc7e62f05087e78376b8812f33d6a845d163d8e91a7ae8573d1da9d56

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0db1d88802048ff847bfcf47035335bd
SHA1 bb54059e5b145da464f6521ae67353889ce00771
SHA256 416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a
SHA512 32c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index~RFe5dd0d0.TMP

MD5 089f85054cdc601a0b20ef4d2723c910
SHA1 6530f3bb90877d3e66dc1c50650b15cff41c8ca1
SHA256 3ada3aa7ea95ae46e6c9961c42dfcfea248d8bc3f5e1e4359d505398d494e8fa
SHA512 f6881a10930bd912d24275beb3d5b60471a8fe20928b6fed46679d2db463e74e1e207574f8307dd8eb94dd30b4734f1ef07ef06d45dad42b15428df1f80a93f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index

MD5 7a808276670d2ba1ada12efce2da7ba9
SHA1 6ea9bb107dbec89ef377afccf615123d77bf8108
SHA256 5a0a30e28464c058c81f3cc4cb4cc27bb9ad28ca05be985f097c0715f3d8a89b
SHA512 83777adf7860c9a97ba57ec55d270f7f197d8850cafdefc214ec33cee7a770a3f1f7877146a098387d5519ea4b184296ed7d52f3a7b9842eedb33e97c1fb0f59

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\Browsers\Microsoft Edge\Cookies.txt

MD5 a717eebd1578da17778e1c333eae0f7d
SHA1 5463464d8efc6a7e7dd29689124ada07bc6f75c1
SHA256 6e50252b520cd029e23c11fc227434f67e2f608bd19a41e3b590761ee35524c9
SHA512 2c78f5eeec5d81fa634f24ddc6102f565a649f60ee0eb7a23ccee9484a61c3f2c388b81ebbf79671f036aee2b56d0781a19fee0bd14aa0643ad770d1e5706029

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\System\Apps.txt

MD5 2d8a541571dcb2f16fc07676bff7aea7
SHA1 c9a233068b97845dc4a52612a4cd6d284745f1ba
SHA256 683a1cac2cdca1bed6d448d8681ff75c1ffd86290627313424530208a5835b11
SHA512 3e91e2d7510e55b1013459993633489991d8ab90e0ec60da0e36aa1514980e6ffe1fba7465f28949ea0d77ddf843383b6853a28d4b581a3368eaa82862d7b548

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\System\Apps.txt

MD5 e4ded193433bfaed46da466eefcc2c35
SHA1 56151b0cb50efcac84e88cb623af4fc10f82087d
SHA256 b5190a32744b506ceec36dcdade88886a20d999ff72c93f960665cb90defe05c
SHA512 2948192405d25b8b18258d8f30183d082ae5bd53cc2c17743b6cd48b499f98e0820df59ac99c03dfe719202f95d39e761b3881e79dcb1b07504971e0c6a9bcfb

memory/4016-1730-0x000001A563220000-0x000001A563264000-memory.dmp

memory/4016-1731-0x000001A5632C0000-0x000001A5632DA000-memory.dmp

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\Admin@QJHNVQMW_en-US\Browsers\Firefox\Bookmarks.txt

MD5 70e1643c50773124c0e1dbf69c8be193
SHA1 0e2e6fd8d0b49dddf9ea59013a425d586cb4730c
SHA256 4fe3f09cb4d635df136ea45a11c05f74200fc6e855a75f9a27c0a0d32a2f632a
SHA512 664e5d9263c0137f841daeb3dff00010ffeb7291ed08ccf6d0483200cd6d6bd3c9d31ea7e67a9de6aac591397060d8f01e8469bbad67d8e2f1c3900ef24c3679

C:\Users\Admin\AppData\Local\4472ec2ccfd20e94d840f14f4cd97f57\msgid.dat

MD5 6974ce5ac660610b44d9b9fed0ff9548
SHA1 934385f53d1bd0c1b8493e44d0dfd4c8e88a04bb
SHA256 454f63ac30c8322997ef025edff6abd23e0dbe7b8a3d5126a894e4a168c1b59b
SHA512 947de04bfae0bf062a66fc055d4c284c9779793d9bd58833ee7549fde1ff1effaf7aefdbc6c90ed0ac86c0acc82329e7c057d900c28ea7ed4724486f717ee38d

C:\Users\Admin\AppData\Local\Temp\5c956969-f631-4266-8f89-966e97baf325.bat

MD5 6be7699a73dd3054d652de90ce1f6c00
SHA1 a872a50aa9116e06f467b3fc1faad8f231b6dff5
SHA256 69e2425d5a652bd4a0f531f413bdde370b1be9259215099d5027973b0d728eec
SHA512 4f5faa1ceedd796e0df7bf9379dcefb3b6e4dcd14d9fa57c58840bbd59a90e9dc6a04d67ebc7db95fa2f39a909468890e8228c91a2569455ad2ef7ec5a3ccd27

memory/4016-1805-0x00007FF81E500000-0x00007FF81EFC1000-memory.dmp