hxxps://docs[.]google[.]com/uc?export=download&id=1dtRG2SW79MuV-2S83nBCnjSrMRYHbcYn

Analysis

user interaction
yes
max time kernel
170s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20260130-es
resource tags

arch:x64arch:x86image:win10v2004-20260130-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
20/04/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/uc?export=download&id=1dtRG2SW79MuV-2S83nBCnjSrMRYHbcYn
Sample260420-txk5vact2t

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	1720	powershell.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	1720	powershell.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	1720	powershell.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	1720	powershell.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	1720	powershell.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	1720	powershell.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	1720	powershell.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	1720	powershell.exe	97

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
37	2340	powershell.exe
68	1180	powershell.exe
70	4952	powershell.exe
71	4008	powershell.exe
86	3800	powershell.exe
87	652	powershell.exe
89	692	powershell.exe
90	1476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4008	powershell.exe
3800	powershell.exe
652	powershell.exe
692	powershell.exe
1476	powershell.exe
2340	powershell.exe
1180	powershell.exe
4952	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 1688	2340	powershell.exe	116
PID 4952 set thread context of 868	4952	powershell.exe	132

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5028	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211760085874099"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4680	chrome.exe
4680	chrome.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
4680	chrome.exe
4680	chrome.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4008	powershell.exe
4008	powershell.exe
4008	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
652	powershell.exe
652	powershell.exe
652	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe
Token: SeShutdownPrivilege	4680	chrome.exe
Token: SeCreatePagefilePrivilege	4680	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe
4680	chrome.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2416	4680	chrome.exe	86
PID 4680 wrote to memory of 3164	4680	chrome.exe	87
PID 4680 wrote to memory of 3164	4680	chrome.exe	87
PID 4680 wrote to memory of 5028	4680	chrome.exe	88
PID 4680 wrote to memory of 3920	4680	chrome.exe	89
PID 4680 wrote to memory of 3920	4680	chrome.exe	89
PID 4680 wrote to memory of 772	4680	chrome.exe	90
PID 4680 wrote to memory of 692	4680	chrome.exe	91
PID 4680 wrote to memory of 772	4680	chrome.exe	90
PID 4680 wrote to memory of 692	4680	chrome.exe	91
PID 4680 wrote to memory of 4916	4680	chrome.exe	93
PID 4680 wrote to memory of 4916	4680	chrome.exe	93
PID 4680 wrote to memory of 4228	4680	chrome.exe	95
PID 4680 wrote to memory of 4228	4680	chrome.exe	95
PID 4680 wrote to memory of 216	4680	chrome.exe	96
PID 4680 wrote to memory of 1388	4680	chrome.exe	99
PID 4680 wrote to memory of 1388	4680	chrome.exe	99
PID 4680 wrote to memory of 2076	4680	chrome.exe	100
PID 4680 wrote to memory of 2076	4680	chrome.exe	100
PID 4680 wrote to memory of 2072	4680	chrome.exe	101
PID 4680 wrote to memory of 2072	4680	chrome.exe	101
PID 4680 wrote to memory of 4584	4680	chrome.exe	102
PID 4680 wrote to memory of 4584	4680	chrome.exe	102
PID 4680 wrote to memory of 2616	4680	chrome.exe	103
PID 4680 wrote to memory of 2616	4680	chrome.exe	103
PID 4680 wrote to memory of 4392	4680	chrome.exe	104
PID 4680 wrote to memory of 1300	4680	chrome.exe	107
PID 4680 wrote to memory of 4112	4680	chrome.exe	108
PID 4680 wrote to memory of 1200	4680	chrome.exe	109
PID 2340 wrote to memory of 4344	2340	powershell.exe	115
PID 2340 wrote to memory of 1688	2340	powershell.exe	116
PID 2340 wrote to memory of 1688	2340	powershell.exe	116
PID 2340 wrote to memory of 1688	2340	powershell.exe	116
PID 2340 wrote to memory of 1688	2340	powershell.exe	116
PID 2340 wrote to memory of 1688	2340	powershell.exe	116
PID 4952 wrote to memory of 868	4952	powershell.exe	132
PID 4952 wrote to memory of 868	4952	powershell.exe	132
PID 4952 wrote to memory of 868	4952	powershell.exe	132
PID 4952 wrote to memory of 868	4952	powershell.exe	132
PID 4952 wrote to memory of 868	4952	powershell.exe	132
PID 4680 wrote to memory of 812	4680	chrome.exe	139
PID 4680 wrote to memory of 1060	4680	chrome.exe	140
PID 4680 wrote to memory of 1060	4680	chrome.exe	140
PID 4680 wrote to memory of 928	4680	chrome.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/uc?export=download&id=1dtRG2SW79MuV-2S83nBCnjSrMRYHbcYn
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf69ac728,0x7ffbf69ac734,0x7ffbf69ac740
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,2270914608703865481,13228149451114048027,262144 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,5596544416658843123,13923741965502412545,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,14382011958115091500,7795906968157848301,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,6488449208374332718,4172469612933564030,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,9666191379424801995,7441344085779597225,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,11928184954122154353,6789983726677741649,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,176193982681103667,5124900422064993233,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,8774372511118938258,2476129787136730006,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5700,i,15142595370719097392,15126095973358462339,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4364,i,12648985508446859550,2809033204153892577,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3308,i,9324804426103520879,11710464248642964825,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4732,i,7843338443763368615,18017673850642465050,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5828,i,1067504439641801686,1368650254211666332,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,2616371414190213375,585510056333195706,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,5924346065044295216,15508240302004000925,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,6449403541674945272,8236072771731959048,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1516,i,8060355673795393810,8188874099404895148,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5944,i,633687146480982136,14485324780685674527,262144 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4424,i,12978221152039828515,5461193545800719090,2097152 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,7661822672684887078,7286143756921521169,524288 --field-trial-handle=2080,i,17763861974076533332,15719382726783527242,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:3528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:4344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1688

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:1864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:1652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1180

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:2052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:3900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:3988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES (1).zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:4028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:692

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES (1).zip\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.js"
1⤵
PID:640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "IEX $env:INTERNAL_DB_CACHE;[Environment]::SetEnvironmentVariable('INTERNAL_DB_CACHE',$null,'User')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

131d6853-302a-4e7b-9a0e-4e220b7c2411.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\131d6853-302a-4e7b-9a0e-4e220b7c2411.tmp
Size 17KB
SHA256 45395b0415b9015717ad38965e5770784e9d8eb5adb0104faee6c95904ed9727
MD5 66eb6c128e0015522988e49dbfb67086
SHA1 6d18dd59e27af3aea94e057fa29b185f0374d470
SHA512 64e205701f1ef92c864978e2cc9a65fcb62f4debbce1ea7755d0ab24d1af5d7d28c42eb32ae0d7714fcadf3b68cb0c2c4a794e32652ae62125d991863c51ceea
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLILcmfU1XODid+ErU3+mH1dTRzy:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pn
TLSH
T1BA7209676C0C9E3B4F94C98CD8267F4FADB5014BA5DAC85443FA982903D5ACF11462FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 da9277939a4d0029ce00f4aa5ee8b459fa00d4b12d325babd4c94788d73aecec
MD5 8a6f789625f5b94a84cc940f4de44c2c
SHA1 a35feedbbace453c829abcac49396c8c5cd9d315
SHA512 db33ecfb0a468ef1eb5666861de971325ab09240dd3456dec0fb3fdbb005a56c2d869d620404fdd76352f2711b28bf8dc8c5753fd32ce0f486fdcfda166c6d73
TLSH
T1FEE02BAAC925AC3719FD171920846346EB49279B2741694F3A3D420C8FB037A569781C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 221c2fb8b5b071a80ef4da5625146aef15715f7fc142782804c4ecae51a1edf2
MD5 c2f1ac78663dd2fd4a3952bc4b650de6
SHA1 487ae0d8dce3d5a381ff0c5bbe22b95434b2fd2a
SHA512 2b1806569d4d6b3ffea0582a872a728932dc016d8b1c8b56cd147f81a252e7666e86886d2278fda881b0d18884204d81114ddaa19e8a5107e1176d6866a806a6
TLSH
T1C9619FF793E8897D891196F49B256F2FCE6D0924031C3C66C9D4AE1B53F2972D10079E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f63a4b223a89fad0cc9501b0d17c30f5dacc45cc5b7bb3e4d1858ae63d3f30fd
MD5 e168447732a8b726a15ceeea5a314b70
SHA1 8beed40f743afde416eeb0e284e1a980e1ea6198
SHA512 cbde8492c244764c12e29ddf6de0eae79136f524ea71c88d73d4872d6f3a2843f81dab1d6c62e28a676e4e87fb426f6585099df904b1716d9db74408aca0b21a
TLSH
T142518FF793E4897D8911A6F4DB256F2FCE690924031C3CA6C9D4AE1B43F2972D10179E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 83d4ff07c4acf56cb7fcaa5853b8e0cb7858104909d47cc0abb8a23f47cc70e6
MD5 c34375e00dc145036c52b3cc5960cef3
SHA1 577bca991a54e91d4a656f1ead735c79aff1633c
SHA512 b9a029696696380963117d8215708f6e16ebdf8792cbe8cd0706c5669724e06cf7922e93b4c19d39906c8cac7ce9c66328755af90f60094bd28b8ba02c1f7988
SSDEEP 192:WR9CfbYuJjv7rpGPRp0D/UN9+Hsb+WNn6maOgErmU2pHeaQB4VyIsnAUgvU:WR9CDxbf2XHEwvAET20aTvU
TLSH
T15052E82EA9186A7BADDBC21EF9117B17D7F5102130942E88EBFCCA1C15E75CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 50f6a9df2d600160372078b320eed212c22d3f9a90fb32dd4a575178e02ba822
MD5 70ce6cfd2b60d1050483d9e364f8c3e8
SHA1 ec080f1f14796c792b17064f045f96f118c18f18
SHA512 6282ecd831e2c771ada4240684e76db9f26a08ca6c4ecdedc8ad7f49a8c7d96ca85fc359d215d0b7b2f7d18f7a970f603d3c2e4d9c18970145132be19f85c27e
SSDEEP 192:WR9XfbYuJHv7rpAPRp2D/399+Hsb+WNn6malK2xU2pHeaQB6VyIsnAUge:WR9XDxPfUXEEwvx2220aPe
TLSH
T19B42D82EA9187A3B9DDBC21EF9117757D7F5102170842E88EAFCCA2C15E75CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3e722c048031fd67fdc19fd5f3b042719538bcf1743baf4e386967fd1c6fad9f
MD5 dd859ba46f205af0bcc725aa85cb06a9
SHA1 9c6b2adb7be98829e2de53bcef0d3e3cc426a8da
SHA512 ab13734e857c5ed9ea18ea8d7721ba40e3aae542a9954ac89d3c2b7ddbf4b214120f5d99251377a4c46b7bf353869361df67a98c8d15baac0edbd7245a419635
SSDEEP 192:WR9rfbYuJjv7rpAPRp2D/UN9+Hsb+WNn6mahmWdU2pHeaQB6VyIsnAUg5U:WR9rDxbfUXBEwvVWa20aP5U
TLSH
T1E552E82EA9187A3BADDBC21EF9117757D7F5102170842E88EAFCCA2C15E75CD621702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d8c8375d7e8147f522479aa52a09194a180186613e1d2a8c5e6b6b6411e9ff35
MD5 1614d703c29e84fff821c3ce47997197
SHA1 a62ccdf9966bfd954867ae9b224e974a32a9ed6d
SHA512 bd0ca882f781250771ca0ae48972a66aa7ea5b2b50f377752427731c6ac23f522bcb56dcdb9f123f6a3f995b2d60e60d04abb3b60981567c3fec0f689dcc7a1f
TLSH
T1F7B012109001D602C05307F111A604C835945F108705130663E06EB6DD2B5B140145E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584fff.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584fff.TMP
Size 96B
SHA256 b9c360fde2f25c50f01d4f2056a28c26d340d6957bf07e432f4823331a9cfc0d
MD5 5fea57908c9a1e0ab8e9308b7a7ecb55
SHA1 ea849bc0cf67d954d12a8848cc71a8fef86e5ed2
SHA512 2e89e70d294382759eaf1d4a0dfdd4d3f0270c3dd56023facf9cdf0ce04d22f2ba85a167255987e2b8087f4f52aa7a1cceee01ea6ac7aba26c9990f73efd3730
TLSH
T171B00255C11AB322C04203B03596D5DC7961EF69C60B2F73D6E01B77DC29A755526171
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 d482855da050402348c251763d9d1e4f98e9c7cc86ea421238c7e14de49f1567
MD5 c17b0cbde57a7141091d4beb13936b02
SHA1 c7872e28aaa3325016aaceda52eb43d2fc60944d
SHA512 15bbd1513562fb8095bec20db6ab59e5471d30f40ba8bab3b9a177a3ff84216933825052048f9c8053c9d86921e42ee9a4f83a1dfeee379d089c4c4253b11c88
SSDEEP 1536:0V+dcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YF:W+d3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1219302B99E1A49F795BE9A82769E3809CE12234E716F68CC719C534C21D41C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 6b830802b35d8775b8c6f0c3c97ed4a0c71c0d89ad54431fd5f01f6ddde0b9b1
MD5 718dbab73da6f3143b8327af8e1d10aa
SHA1 6c740bae6b8d0402682da5e2cacf674ba6048040
SHA512 b8e896fb11f7740f399d1e1bce7d4ee160846f636ec529dc36518c20f73aac833513fe4ee4f4fad9744a09a90b44f0d2bae34cb2a46ee37ec16044192e72bed6
SSDEEP 1536:jVLcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xL3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1B69302BA5E174AE7957D4A8176AE7808CE12630D70AFA8CC315C638C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 b2dafc593b3e5af4e8338948620a9ff15aae70c62a32aedd94e9472d37b79ce0
MD5 60d65d0843251314eef86a8877557d1a
SHA1 4baea954394584d3edbc2ce24176e31ba1ee084d
SHA512 f9edeb612b65ec38c344e5488ce1801fa8c18779f7b9da9b95b2276725ecd071e0067b7b68b04f0360b465afcedabcafdc1b409904888792063513051717a35c
SSDEEP 1536:0VIcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:WI3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1169312BA5E1A45F7957E56D1769E780ACE12234D309F698C729C538C21D02C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 95911dd21a005869a3287c210d88ce131a955c9b990115c2825061d7ae222c2b
MD5 df19d6bd70f451c8b6e7b00f2a2d16e2
SHA1 29429413d1a93f31a1079ebb982309314bbc826d
SHA512 10cdd3b7c85c3ff2cb0a437e7ad93b97769b2452dfacb150a56da5fb50381b2a26811b67b3aac954908f7a11ba12e1945c68407f526e0e1be241e52d934c0d58
SSDEEP 1536:ZVIcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:DI3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1329312BA5E1A45F7997E56D1769E780ACE12234D309F698C729C538C21D02C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
MD5 f41839a3fe2888c8b3050197bc9a0a05
SHA1 0798941aaf7a53a11ea9ed589752890aee069729
SHA512 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
TLSH
T11161EE323275B1D8C9167F071E28198053BF4396EAA4AF0CB298625EDD2601B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eaf42c219ba436b6cebf9557cea565ba2888b9f8582da6d9d604d6cb00792d7d
MD5 18868e2eebc01c167513fe2037d59da1
SHA1 f9c79d6966848ec68eef235c38f1b7023bf11c3c
SHA512 9017c29aa0d94e86c8435ff84aecacdb85c42c6e3cb5e47e4451bd4f635c3ad8f4a7ac4bdc74c14c296079a2f8f7111fe7e0d0f6f956eb10563977a29d99c7a2
TLSH
T1AF217827F39C8921CC96113A409D9C1172B6C3DB819ECF9F6FC4D214A17F584CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5c968a39a02d5cec13409f341a21fe1a0096d21b1c244ffe9c116a5a30b5ee94
MD5 b3cd423619aa2ef5ea63b84380c7870c
SHA1 cbb64fb189c59ee179ce0ba916c43f751bb47822
SHA512 1f4d7c31289137ee2de3e6fd90c625d1dbfe4efa3f2b717b9bec01b772a84996440125c2eb7b3daa6a1aea43e31554fb4256778f620923d5745a1f4709ccb832
TLSH
T150215627B39C89A1CC96213A009D9C1176B783DB819ECEDF6EC0D214A16F994CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f69815ce297b1f1a3e8c97c6e58cfb175b2f94b58ec120b2bfa9c6811ff812c9
MD5 15ae6ef0b30dd340a082372109a874ec
SHA1 adb98085cd87c68fedd7fb6f191e72de22320da5
SHA512 c823d589110307e9d732d568cd31a5145dd425cc0ab3221da56dbddde73b0beeeab1c54e0211b02688e6fec43e4aee6c9016d0e4a7dc4bfd773f7bfcaee22f04
TLSH
T1DC117A23F39CCA61CC96153A409D9D1172B683D7819EDE9F6FC0E215A07F584CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_a0kqa4yg.ykp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a0kqa4yg.ykp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip.crdownload

Path C:\Users\Admin\Downloads\EJECUCIÓN DE MEDIDAS FISCALES Y SEGUIMIENTO DE OBLIGACIONES FINALES.zip.crdownload
Size 49KB
SHA256 ff5eefeb7ef28d53fa23dd98eb9d3f2a9dcce2ef9d21d9009ef4c11a0623069b
MD5 a6c33a14d93a39087ff6726e0823f50e
SHA1 c8dc8b7b697516a1133789806396625a3a3ac205
SHA512 466df1910feb51dd1c11f1907d71a82d8ddb55a34b621c66700d05c169c5ac98b918cdc08959407825e5adfa2ff4293ae3f75f26ede548ab93fad3afaac888c5
SSDEEP 768:QK0+ISekzgbkI+aS7M/ECwTIWcM9Gy8CT4k2hlPgN1z4PeeqVUkJ0uvct5pDVHBa:SPkz+uaSKCIWcQrKk241f50htTDVha
TLSH
T1EB3302D35EBD14AEDDD1E0E91AE3DB881936ACC8C068E49C5E92CC1E4BC4E345783925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-211-0x0000029EC8840000-0x0000029EC88E9000-memory.dmp

Download

memory/640-288-0x0000020D249A0000-0x0000020D24A49000-memory.dmp

Download

memory/652-240-0x000001E3CFDB0000-0x000001E3CFE59000-memory.dmp

Download

memory/692-287-0x0000023FBE050000-0x0000023FBE0F9000-memory.dmp

Download

memory/868-235-0x0000000000DD0000-0x0000000000EAC000-memory.dmp

Download

memory/868-231-0x0000000000DD0000-0x0000000000EAC000-memory.dmp

Download

memory/1180-178-0x00000218567E0000-0x0000021856889000-memory.dmp

Download

memory/1180-200-0x000002186EE30000-0x000002186EE70000-memory.dmp

Download

memory/1180-202-0x00000218567E0000-0x0000021856889000-memory.dmp

Download

memory/1652-165-0x0000018F5C370000-0x0000018F5C419000-memory.dmp

Download

memory/1688-123-0x0000000006420000-0x0000000006522000-memory.dmp

Download

memory/1688-122-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/1688-126-0x0000000007070000-0x0000000007102000-memory.dmp

Download

memory/1688-121-0x0000000005AA0000-0x0000000005B8A000-memory.dmp

Download

memory/1688-117-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1688-129-0x0000000001510000-0x00000000015EC000-memory.dmp

Download

memory/1688-130-0x0000000005DF0000-0x0000000005DF7000-memory.dmp

Download

memory/1688-127-0x00000000076C0000-0x0000000007C64000-memory.dmp

Download

memory/1864-164-0x00000254FE4C0000-0x00000254FE569000-memory.dmp

Download

memory/1864-128-0x00000254FE4C0000-0x00000254FE569000-memory.dmp

Download

memory/2052-177-0x000001C7D85C0000-0x000001C7D8669000-memory.dmp

Download

memory/2340-104-0x000002B6FE030000-0x000002B6FE0B2000-memory.dmp

Download

memory/2340-113-0x000002B6E58A0000-0x000002B6E58B0000-memory.dmp

Download

memory/2340-112-0x000002B6E58C0000-0x000002B6E58E2000-memory.dmp

Download

memory/2340-114-0x000002B6FE1D0000-0x000002B6FE2D2000-memory.dmp

Download

memory/2340-115-0x000002B6FE670000-0x000002B6FE792000-memory.dmp

Download

memory/2340-116-0x000002B6E58B0000-0x000002B6E58BA000-memory.dmp

Download

memory/2340-120-0x000002B6FDD60000-0x000002B6FDE09000-memory.dmp

Download

memory/3528-103-0x0000020066DC0000-0x0000020066E69000-memory.dmp

Download

memory/3596-13-0x000001D80E070000-0x000001D80E119000-memory.dmp

Download

memory/3800-239-0x0000023209910000-0x00000232099B9000-memory.dmp

Download

memory/3900-188-0x000001753D650000-0x000001753D6F9000-memory.dmp

Download

memory/3988-222-0x000002514DBD0000-0x000002514DC79000-memory.dmp

Download

memory/4008-221-0x000001A40C2D0000-0x000001A40C379000-memory.dmp

Download

memory/4008-203-0x000001A40C2D0000-0x000001A40C379000-memory.dmp

Download

memory/4028-273-0x000001DBE9880000-0x000001DBE9929000-memory.dmp

Download

memory/4952-207-0x0000026875110000-0x00000268751B9000-memory.dmp

Download

memory/4952-197-0x0000026875110000-0x00000268751B9000-memory.dmp

Download