Malware Analysis Report

2025-04-13 12:23

Sample ID 250325-j2cddswqz2
Target 25032025_0809_24032025_Listado FacturasPDF.gz
SHA256 bd78281db9ac530698843738a7d58ec552effaf67d872a2680aa2d1ffbf51812
Tags
stealerium collection credential_access discovery persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd78281db9ac530698843738a7d58ec552effaf67d872a2680aa2d1ffbf51812

Threat Level: Known bad

The file 25032025_0809_24032025_Listado FacturasPDF.gz was found to be: Known bad.

Malicious Activity Summary

stealerium collection credential_access discovery persistence privilege_escalation spyware stealer

Stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess

Stealerium family

Uses browser remote debugging

Checks computer location settings

Reads user/profile data of web browsers

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Browser Information Discovery

Unsigned PE

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

outlook_win_path

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies data under HKEY_USERS

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-25 08:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-25 08:09

Reported

2025-03-25 08:14

Platform

win7-20241023-en

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2380 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Windows\system32\WerFault.exe
PID 2380 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Windows\system32\WerFault.exe
PID 2380 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe

"C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2380 -s 1136

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.total-procurement.com udp
US 172.245.136.70:443 www.total-procurement.com tcp

Files

memory/2380-0-0x000007FEF53A3000-0x000007FEF53A4000-memory.dmp

memory/2380-1-0x0000000000230000-0x0000000000236000-memory.dmp

memory/2380-2-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

memory/2380-3-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-25 08:09

Reported

2025-03-25 08:14

Platform

win10v2004-20250314-en

Max time kernel

251s

Max time network

215s

Command Line

C:\Windows\Explorer.EXE

Signatures

Stealerium

stealer stealerium

Stealerium family

stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2860 created 3356 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Windows\Explorer.EXE

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2860 set thread context of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873638999840403" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe
PID 2860 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe
PID 2860 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe
PID 2860 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe
PID 2860 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe
PID 2860 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe
PID 3144 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3144 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 4764 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 4764 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3144 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Windows\SYSTEM32\cmd.exe
PID 3144 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe C:\Windows\SYSTEM32\cmd.exe
PID 1800 wrote to memory of 2336 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\chcp.com
PID 1800 wrote to memory of 2336 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\chcp.com
PID 1800 wrote to memory of 4604 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 1800 wrote to memory of 4604 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 1800 wrote to memory of 5068 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\findstr.exe
PID 1800 wrote to memory of 5068 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\findstr.exe
PID 4400 wrote to memory of 2492 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 2492 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4400 wrote to memory of 1236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe

"C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe"

C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe

"C:\Users\Admin\AppData\Local\Temp\Listado Facturas.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff8a636dcf8,0x7ff8a636dd04,0x7ff8a636dd10

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\findstr.exe

findstr All

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2044,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2040 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2004,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=1996 /prefetch:2

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2484,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2480 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3064 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2816,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=2828 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3892,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=3740 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4652,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=4648 /prefetch:1

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5252,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5248 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5484,i,10935116800968559982,9444085306908102720,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --disable-logging --mojo-platform-channel-handle=5384 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ff8a53cf208,0x7ff8a53cf214,0x7ff8a53cf220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2208,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2264,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2404,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2136 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4136,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4152,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3604,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4872 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5144,i,17694699991385803438,5127087861626465518,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3540 /prefetch:8

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ccbc561f-811b-4013-bf7b-4b242c34fa0b.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3144

C:\Windows\system32\timeout.exe

timeout /T 2 /NOBREAK

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.total-procurement.com udp
US 172.245.136.70:443 www.total-procurement.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 www.google.com udp
GB 172.217.169.36:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.10:443 ogads-pa.googleapis.com udp
GB 216.58.212.238:443 apis.google.com udp
GB 142.250.200.10:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 clients2.google.com udp
GB 216.58.204.78:443 play.google.com udp
GB 216.58.204.78:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 play.google.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 clients2.google.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 150.171.28.11:80 edge.microsoft.com tcp
GB 172.217.16.238:443 clients2.google.com tcp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
GB 95.100.153.132:443 copilot.microsoft.com tcp
US 150.171.28.11:80 edge.microsoft.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.187.193:443 clients2.googleusercontent.com tcp
GB 142.250.187.193:443 clients2.googleusercontent.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.bing.com udp
US 8.8.8.8:53 c.bing.com udp
GB 2.20.12.73:443 assets.msn.com tcp
GB 2.20.12.73:443 assets.msn.com tcp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
IE 13.74.129.1:443 c.msn.com tcp
US 150.171.27.10:443 c.bing.com tcp
GB 2.20.12.73:443 assets.msn.com tcp
GB 2.20.12.82:443 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
GB 95.100.153.143:443 www.bing.com tcp
GB 95.100.153.131:443 www.bing.com tcp
GB 18.165.242.110:443 sb.scorecardresearch.com tcp
GB 2.19.252.151:443 img-s-msn-com.akamaized.net tcp
GB 2.20.12.73:443 assets.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
IE 13.74.129.1:443 c.msn.com tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
GB 2.20.12.73:443 assets.msn.com udp
GB 2.20.12.73:443 assets.msn.com udp
US 20.189.173.12:443 browser.events.data.msn.com tcp
GB 2.20.12.73:443 assets.msn.com tcp
GB 2.20.12.73:443 assets.msn.com tcp
US 8.8.8.8:53 evcs-ocsp.ws.symantec.com udp
GB 104.78.173.45:80 evcs-ocsp.ws.symantec.com tcp
US 8.8.8.8:53 evcs-crl.ws.symantec.com udp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
GB 104.78.173.45:80 evcs-crl.ws.symantec.com tcp
US 104.16.184.241:80 icanhazip.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 104.16.184.241:80 icanhazip.com tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/2860-0-0x00007FF8A9BD3000-0x00007FF8A9BD5000-memory.dmp

memory/2860-1-0x000001ADC2210000-0x000001ADC2216000-memory.dmp

memory/2860-2-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-3-0x00007FF8A9BD3000-0x00007FF8A9BD5000-memory.dmp

memory/2860-4-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-5-0x000001ADDC9A0000-0x000001ADDD174000-memory.dmp

memory/2860-6-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-13-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-15-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-21-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-33-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-31-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-29-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-27-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-25-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-23-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-17-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-19-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-11-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-9-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-7-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-55-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-63-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-69-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-67-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-66-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-61-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-59-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-57-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-53-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-49-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-45-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-41-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-37-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-51-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-47-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-43-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-39-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-35-0x000001ADDC9A0000-0x000001ADDD16E000-memory.dmp

memory/2860-1342-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-1343-0x000001ADDD170000-0x000001ADDD89C000-memory.dmp

memory/2860-1344-0x000001ADDD8A0000-0x000001ADDDFC8000-memory.dmp

memory/2860-1346-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-1345-0x000001ADDC6D0000-0x000001ADDC71C000-memory.dmp

memory/2860-1347-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-1348-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-1349-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-1350-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-1351-0x000001ADDDFD0000-0x000001ADDE024000-memory.dmp

memory/2860-1356-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/3144-1359-0x0000000000400000-0x0000000000B0E000-memory.dmp

memory/2860-1358-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/2860-1360-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/3144-1361-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/3144-1373-0x000002A14A550000-0x000002A14A602000-memory.dmp

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\System\Process.txt

MD5 10331f2cb14c823930a51d49be301275
SHA1 74cb14e9b2eb9799a7b2182211c17a2f334f8a4f
SHA256 6d824f7bedb8ea6b6671a34edc882b2de650ec5e1806ad1de3170f4d6505da8f
SHA512 7f21a1e004971f73a7875c0dfde17f3f5043a1c1ec1a4816d0124645d4eb25020a381ef89a89e3c6fb42713ca26710dd2b9218b1540e1a4dc43ad2ab14dc0ce5

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\System\Process.txt

MD5 76494a4624a0717b854680531b0bfd11
SHA1 56c70c006cfbec939236a8a2155dda980e9ca9ff
SHA256 d224738c033377d23451c6e91cea3766f0135135a6eb385a16f6e55a76d4cb14
SHA512 79ec554a07c122c7007c8066a0007bb56c6792b01abfdc4adb32f9d55ea85f5242bfcc511c1c1725c0fd46d239a36d086eea2e25bc76ba15252e4cb7bd85f842

\??\pipe\crashpad_4400_EBCZCTVOIRSAPUVA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6a5ab5bad44cd0c1b79cb4e983575fb8
SHA1 8f739e118c2a954879c8cd5318f6f192c9ece8bf
SHA256 930e92fbf286488c1a258db1706c2c9b4af6542ed8b4ccface41cdc7b1a9ed50
SHA512 eaba6765232f9a5ef7aaf4316c869ee416df0e5def8df088962b1096f99bd4a8afd79d62c5c3c0cbf11c65a8ef34f91db2c3e62029826022257467b15280a63b

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\System\Process.txt

MD5 b42792005b790ac989e2b1afbdbe03e1
SHA1 53c9609e6922ea3bd90c1e1080545d9957c16489
SHA256 2677fc4dadcf5aad5e912d01545ae304eb14b01902de33c93138f5eee8959565
SHA512 6903da7f403f5937b73ac8e7333abf0b6478c5b8ed420748f8192e4aab75ee774ac50fc162d759077a026a913b79a371715a22ee16671fc869a3119742900693

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\System\Process.txt

MD5 d6cb68647ec05a2e44a16571aef674eb
SHA1 d82e6683deba5b211b1993a696fdf490985ca457
SHA256 f5173d73ee589ded729f7d79cb590f42d59b32882a467a3052ec98b0cb97b00d
SHA512 fb5e43c68d3391ff684ced9559d6b68077d2270255c5ac7ee90912caf11f453117c02b33457c4846d3e62dda85021365398c7db97787089952030e052a74ed57

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\System\Process.txt

MD5 d49d626e0b12a3e92675a884c7499af4
SHA1 cbcdbf236da659e15725337af7563e1bee1a0ba3
SHA256 0a4143677170c53730b6249161d2b894e114e0106228bf4f1a05696625d66503
SHA512 78db6d85a15c08e520f7a27399f62b1f71cc82002865ece622e39d4d204d123acd4974577f81d80169f04424a7bfbfdf11fff5976c8c5ca4ce5388f3fb9bea22

memory/3144-1512-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp

memory/3144-1518-0x000002A14A920000-0x000002A14A942000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 049e5a246ed025dee243db0ba8e2984c
SHA1 15ec2d2b28dcfc17c1cfb5d0c13482d0706f942d
SHA256 33071ca42c472861a2fabd0f82f8b03ef0daaa6796b24b83f3df02587e4c3d12
SHA512 bc5f6fa6a8cae20ab40eae4552650d75f38ebb158c95288a79d9f332623bb507946513c39d19c00a5aee323df01f0f1a51c54594ef1c293289baf45f4ae2145b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c82c6a08428f19010eab39d0938b4d55
SHA1 2a2ecce9520e8b4cb3f8a53e867bbf03f34fb9ab
SHA256 deee92fa543383080d358155f6cc49f3f85d186e3c42f8b833f8ebb04b452980
SHA512 9c7575bf6632c5c069f51bbb7e58101a9092bbe6718b9dee9f1b6fbae7b5493d9f55d205cd1e1dc0204daf21fb851df3dea1dced3d5775167ef0f784b8e0536b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4facd0ff10154cde70c99baa7df81001
SHA1 65267ea75bcb63edd2905e288d7b96b543708205
SHA256 a13534df0cd0a79a3a1b91085a6d575b47d5a9aad7fc6d712fd2616c0e95a23b
SHA512 ad8d2b965851c0ddc23e92ae151b3b0b2bcda850c446f4278bdb0754d6b42ead8fc034b394749578a27b33ad7e4ab0633f974dfd4773fbe4d93ae477f00b73f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 32e9580d0d16979dda33e0abe9bafdbe
SHA1 ce796306a29d1ba778ae87cc22f4b140c228dd8d
SHA256 77f1eb429e5febf650f13616211d4767c3d87dd186b2f0739772643e594ad04c
SHA512 0e1a771496944e15926bea7033b85d68ed8e7d5f3a6dcff1415b8517f6bebee500e9399419bd4da619d5e885ad123ed469edebb41f2fd24138d8508a1aebeb1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index

MD5 d15fc661349aea5fe61fa6a52d9e9a32
SHA1 f6d3ea9bfddf9da25d8ef175722c00f01a7b0845
SHA256 d32fc2b7adf533d525dfb655d70dbd7296659d6faa6badddc67fd376f7a1d238
SHA512 ae23c669a90ffe8f82309ee257e7a2acbdf769d6d5a0f545b15e387cc445060cc6a8a7616813bbeca0f1c0477173f5ad4a8e4772e8123a2042835eb74397f328

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index~RFe59a956.TMP

MD5 6915a279d7191c3463f46045d5815e50
SHA1 dff123c384fc1fca219c7e0c8d69081efe2319fc
SHA256 d94ef4b8f195fb7402800aaa9659c8d58286feb6a296e6ffda568cf633975e4b
SHA512 624b0de0a71fffa5bbe05ec62ec04c442a22b6aab2f74cee20b74285e88cb3072f0ee466ed29c4e3bab6723f91b0db0b859bea156fcb0213ee74bf830ee3eefb

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\Browsers\Microsoft Edge\Cookies.txt

MD5 3360c2bed7d7f751ac7259cd3bd672aa
SHA1 2bdeb597f005ade8d54296575a4af4cd152579eb
SHA256 ef04724bef2a8f44bcb2c0e1c1a491019a4b2da671c4bbf5a8e6bde51d544697
SHA512 cf9158671aad48c906ccae02a3c654a2eeed0f9c916dbd55a7479246cb10588bd346ac46e5ef43ae7d51ab3a80a2fddc857189b9130ebebe4486205d10ca876f

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\System\Apps.txt

MD5 1f2f7e2e5bd9daf5e5640fd68fab0a37
SHA1 e9bbbab5a1de8a17da0322f9e72375829f6db3d8
SHA256 83c148d55d15369670a5b03096a996168f9da8fb581fcff00fbdb12efb5ae042
SHA512 a1299e2930e92b3522cabd5c2bfebaf29fef80e4fa476b67f8f3df299f10895524dd3b0043bdfb5ab7455a71e0db1f3001c17aaca2a6b4424aeadd564ae74157

memory/3144-1727-0x000002A14A710000-0x000002A14A754000-memory.dmp

memory/3144-1728-0x000002A14A970000-0x000002A14A98A000-memory.dmp

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\Admin@BMIVDHSR_en-US\Browsers\Firefox\Bookmarks.txt

MD5 70e1643c50773124c0e1dbf69c8be193
SHA1 0e2e6fd8d0b49dddf9ea59013a425d586cb4730c
SHA256 4fe3f09cb4d635df136ea45a11c05f74200fc6e855a75f9a27c0a0d32a2f632a
SHA512 664e5d9263c0137f841daeb3dff00010ffeb7291ed08ccf6d0483200cd6d6bd3c9d31ea7e67a9de6aac591397060d8f01e8469bbad67d8e2f1c3900ef24c3679

C:\Users\Admin\AppData\Local\6e8405e64573f3b6f194b49d3b9aaa71\msgid.dat

MD5 32bb90e8976aab5298d5da10fe66f21d
SHA1 c097638f92de80ba8d6c696b26e6e601a5f61eb7
SHA256 8722616204217eddb39e7df969e0698aed8e599ba62ed2de1ce49b03ade0fede
SHA512 8bd4964ded25d2608bbfd709784f9ca9893b6e3e51ec556d7c368c561a2c4f4135266ec7bb6fdeb3651213ea2a8eaf2ef3711b8a51f86c3816c821a62d2694ea

C:\Users\Admin\AppData\Local\Temp\ccbc561f-811b-4013-bf7b-4b242c34fa0b.bat

MD5 a1b5fd0e3a4c9ab9e3b39c50be1a5e08
SHA1 0afac0bf18b9fceff1093c9703436ca0675e14dc
SHA256 d1b940c65bb5c3211f64d902a72db9a47396b5a7c92377e30a4488e67071a48c
SHA512 75c1231a09acd2fc26107382d80d06eecbb96b44af5452c9398e51a49bb05fbd2e7682665e142be6685f90fe98fc13eca3afccd27f197da9f91a4cb97eb6fe2b

memory/3144-1824-0x00007FF8A9BD0000-0x00007FF8AA691000-memory.dmp