78783d1a36be983748c2dbb3ed8ad4f1f256acab2dfa92d40cdbec65d2d215a7

Analysis

user interaction
yes
max time kernel
117s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
08/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHA-Attachment 20240719.xhtml
Size 1.2MB
Sample260708-vtl4eaev5x
SHA256 78783d1a36be983748c2dbb3ed8ad4f1f256acab2dfa92d40cdbec65d2d215a7
MD5 807da8f347c96063a6da2700aceab1f1
SHA1 fb5fac66824b91eeb2a211da146c58167961d393
SHA512 42155e4a8f32b0509f60ec67e6c36f2bbe9df4d6901392c8de2d7c4fb108c9984952d5b80d15b58964ba2c0bd3271ecd946c33841d35e234442acb95dc020175
SSDEEP 24576:RvR1uPTHObSFII+wunJcqMnoyZbI5X+r5WOQtby2ZVIi6xXENrHS4xRS6:l6PTHmSFIIH8
TLSH
T13845E0BC62042DAE27BE527EFCD31CD51AD51953CA9F90CEC09961C308A36B5FD2B40A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4644	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Deletes itself 1 IoCs

pid	Process
2236	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoreSvc274.exe	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoreSvc274.exe	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender.vbs\""	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 1592	4644	powershell.exe	131

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4408_119183786\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4408_2061929986\_locales\fr_CA\messages.json	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe.tmp	RegAsm.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
752	cmd.exe
2348	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2704	chrome.exe
4472	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280046555979418"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F721C680-F560-45D8-8BE2-F226B080B811}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2348	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
4644	powershell.exe
4644	powershell.exe
4644	powershell.exe
2808	chrome.exe
2808	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
4408	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4148	2808	chrome.exe	85
PID 2808 wrote to memory of 5820	2808	chrome.exe	86
PID 2808 wrote to memory of 5820	2808	chrome.exe	86
PID 2808 wrote to memory of 2704	2808	chrome.exe	87
PID 2808 wrote to memory of 4092	2808	chrome.exe	88
PID 2808 wrote to memory of 4092	2808	chrome.exe	88
PID 2808 wrote to memory of 4344	2808	chrome.exe	90
PID 2808 wrote to memory of 1752	2808	chrome.exe	91
PID 2808 wrote to memory of 4344	2808	chrome.exe	90
PID 2808 wrote to memory of 1752	2808	chrome.exe	91
PID 2808 wrote to memory of 5480	2808	chrome.exe	92
PID 2808 wrote to memory of 5480	2808	chrome.exe	92
PID 2808 wrote to memory of 5624	2808	chrome.exe	95
PID 2808 wrote to memory of 3792	2808	chrome.exe	103
PID 2808 wrote to memory of 3792	2808	chrome.exe	103
PID 2808 wrote to memory of 3592	2808	chrome.exe	104
PID 2808 wrote to memory of 5140	2808	chrome.exe	109
PID 2808 wrote to memory of 1064	2808	chrome.exe	110
PID 2808 wrote to memory of 1376	2808	chrome.exe	111
PID 2236 wrote to memory of 2796	2236	WScript.exe	113
PID 2236 wrote to memory of 752	2236	WScript.exe	114
PID 752 wrote to memory of 2348	752	cmd.exe	116
PID 2796 wrote to memory of 4408	2796	wscript.exe	117
PID 2796 wrote to memory of 4644	2796	wscript.exe	118
PID 4408 wrote to memory of 4868	4408	msedge.exe	119
PID 4408 wrote to memory of 4472	4408	msedge.exe	122
PID 4408 wrote to memory of 5324	4408	msedge.exe	123
PID 4408 wrote to memory of 5324	4408	msedge.exe	123
PID 4408 wrote to memory of 5324	4408	msedge.exe	123
PID 4408 wrote to memory of 5764	4408	msedge.exe	124
PID 4408 wrote to memory of 5764	4408	msedge.exe	124
PID 4408 wrote to memory of 3016	4408	msedge.exe	125
PID 4408 wrote to memory of 3016	4408	msedge.exe	125
PID 4408 wrote to memory of 3016	4408	msedge.exe	125
PID 4408 wrote to memory of 3368	4408	msedge.exe	126
PID 4408 wrote to memory of 3368	4408	msedge.exe	126
PID 4408 wrote to memory of 3368	4408	msedge.exe	126
PID 4644 wrote to memory of 1592	4644	powershell.exe	131
PID 4644 wrote to memory of 1592	4644	powershell.exe	131
PID 4644 wrote to memory of 1592	4644	powershell.exe	131
PID 4644 wrote to memory of 1592	4644	powershell.exe	131
PID 4644 wrote to memory of 1592	4644	powershell.exe	131
PID 4644 wrote to memory of 1592	4644	powershell.exe	131
PID 4644 wrote to memory of 1592	4644	powershell.exe	131
PID 4408 wrote to memory of 5952	4408	msedge.exe	133
PID 4408 wrote to memory of 5952	4408	msedge.exe	133
PID 4408 wrote to memory of 5428	4408	msedge.exe	134
PID 4408 wrote to memory of 5428	4408	msedge.exe	134
PID 4408 wrote to memory of 4296	4408	msedge.exe	136
PID 4408 wrote to memory of 1000	4408	msedge.exe	140
PID 4408 wrote to memory of 3280	4408	msedge.exe	141
PID 4408 wrote to memory of 5612	4408	msedge.exe	142
PID 4408 wrote to memory of 3768	4408	msedge.exe	143
PID 4408 wrote to memory of 3768	4408	msedge.exe	143
PID 4408 wrote to memory of 4188	4408	msedge.exe	144
PID 4408 wrote to memory of 4188	4408	msedge.exe	144
PID 4408 wrote to memory of 4316	4408	msedge.exe	146
PID 4408 wrote to memory of 4316	4408	msedge.exe	146

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SHA-Attachment 20240719.xhtml
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab406c728,0x7ffab406c734,0x7ffab406c740
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,10167035297641197815,6579178879472371721,262144 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1576,i,15200816467381076416,17630468315380132734,524288 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2388,i,7385827310202277700,3006193402175281446,524288 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,637505391301122662,11401230966208049838,2097152 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,15373122888225888966,17218803778904042914,2097152 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,17477940228803967778,13900834360013735763,2097152 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5340,i,6578271284530667262,11753892866489324917,524288 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5684,i,11438297159823741974,2612520192386813147,2097152 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5876,i,2211273354598337539,7838313733913672532,524288 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5436,i,6125983542888589790,16199954070853296148,524288 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5352,i,9343080915065246155,16435792225289754921,524288 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5644,i,11087069259411318897,15825230762814582300,524288 --field-trial-handle=2012,i,7469345076158276046,16367526455877995248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3472

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Juicio_Contencioso_Administrativo_Tribunal_Federal_JCIV0708-156\Juicio_Contencioso_Administrativo_Tribunal_Federal_JCIV0708-156.js"
1⤵
- Checks computer location settings
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFZJ7wNc.tmp"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\notificacion_32313.html
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffa9c93c188,0x7ffa9c93c194,0x7ffa9c93c1a0
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,6393094138408579874,12860608904800905582,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
      4⤵
      System Time Discovery
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,12752268052132554257,18355437431814703454,262144 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,10384623730676880229,6193318103852346551,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,14560936054729697741,13273231509576049916,2097152 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16385836679811371663,12298844879200522430,2097152 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,2506021751426643271,5090824086765281190,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,7893279564215734897,17385411013860963021,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,14763357536874709983,4819606779139603855,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,14763357536874709983,4819606779139603855,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,5317701816577299797,1157167276648186034,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,10176969740337717387,5328997070971026744,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,2502135481738873974,13307450025195842167,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,213733725719631558,8410899436738354477,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6274940913841873660,2878302755299062464,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10221901764719026744,8826089339837644744,524288 --field-trial-handle=2264,i,4897886893615292937,13562336496928204461,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -NoLogo -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\7C7C2A7F.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
      4⤵
      Drops startup file
      Drops file in Windows directory
      PID:1592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 > nul & del /f /q "C:\Users\Admin\Downloads\Juicio_Contencioso_Administrativo_Tribunal_Federal_JCIV0708-156\Juicio_Contencioso_Administrativo_Tribunal_Federal_JCIV0708-156.js"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8ef6db01a65021244cf81b80195858ae1e15f63cdda01f4d20dc43ab0f2e4a6a
MD5 facc71548acc5e5d7bfc8ae861735d9f
SHA1 aa5a0b3e3d1a3703a9999fc061229e9f554bd1a3
SHA512 e25fdc294d1fdcaf89fb7c1f79373f221ebd145c542dcc0de127a1667c085733c66231e55f9687a5265100be3592caf69096b97cddf5bb10ec274a7c134810ab
TLSH
T1E0E02BAACAA2DC372CFD076CA1501745EA5553573B40448B7B3C85084F7523A4656C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f83e60449fe09099250a749b11cd4a86d14fc855e800c1d9f23406de3bb289c7
MD5 dfe9364e6725f8f59af1a421a4034f5a
SHA1 8f05a1de769efbfd709e8ee5258a98097fa52925
SHA512 ca497ffe8f7807bf78d7b582ed52f6f0879d5625e7f85f82abd19add0db563821c70d5837ecf0494b76f97be314ef745957e841f257085f750a1c16aa0bffc17
TLSH
T1C3419BF793B4957E8A1192F4EB15AE1FCE690624131C3CA6C9D46E1B43F2972D10079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2aa80be79e80826f0fa3c396035ca02d2289ac2859ee525abc798f026dc703fb
MD5 640ca25f5cb7bf1e9cb5da3ec63ec426
SHA1 adebd8c88e07842bb2af52647260204a0571e44a
SHA512 e14666dc5bc54b6a5667879c5c0a6a18106e3759ea6d482fba0875362cfec28bca164c3991c41e243e4888500456c512a1a1e5ab73ef80244b0d418d3c4317ce
SSDEEP 192:5R/3CmTPiSF2Dv71hpAPRp2OR92Hsb+WNn2wPzQ2nrnVyIsnAUge:5R/3/2R7BhUXJQwNPs2nde
TLSH
T16042D42EA915697B6CCBD22AFD267B43D7F5002125E12E80E7FCCA1C14EB5CC222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0c760e9201100b25c5f34031c105118842af591e43425f20761bcac87e25c552
MD5 3b83664a555518a92abb08a748d4ffa9
SHA1 4297de4860a1b0d265688d0234d5d2beac085407
SHA512 f9fde78b5d1617b35895a11e0e9b0c641720204031f9e16510eb0f62dc58a3eb06ad1ade3a71dfca1feb2c9766c2f11bb9ff9974f9d3e4e7bb902c1ce2fe2ec6
SSDEEP 192:5R/TCmTPiSF2Hv71hpAPRp2OR92Hsb+WNn2wPzQ2nrnVyIsnAUge:5R/T/2RPBhUXJQwNPs2nde
TLSH
T1D742D42EA915697B6CCBD22AFD267B43D7F5102125E12E84E7FCCA1C14EB5CC222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 389795aaad6a2071635cc515a2647c2e6ec4d0a43f2593b1bf245ab7a95f343a
MD5 43f7f1942b77291f69a6155c7179c69e
SHA1 f58ba0c0499e17a50daf2679f9a40a71a088034c
SHA512 b48ed78927395e9356b3007e29822621f24c10e3f34b4b12553133d64a5f2acc3f7af0f500a09a2b2f599ca861fe96becb898b574fbd91bc7e925dd259821e0e
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLILc2jwxXODKh+ErU3wZSH1/A1iYPj:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG6977
TLSH
T1E872F967684C8E770F94C6CCE8177B4F9DB5024B65E9C86443FA982903D5BCA114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ab78e43e722796db543c481c5b5b16c182bb1a2bfe35b38e18807f8ac6963ce3
MD5 e17ded132ef742fbffb45aa73fe8a7ef
SHA1 5161f663b8b893dbb5b27507b48326c7d58f7d64
SHA512 119d7e26e5203f33dbeadc170bbf1092fb0c2aabf42bac710768c8f1ce295fe5a6ea29479f55237037e6c3080cb3f6939c387f4c5afb202ce4af0699d962863d
TLSH
T16AB0124080815601C01602F42286399871189F10A60A2B0193E06932C8293508114061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ab9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ab9.TMP
Size 96B
SHA256 39a23206ef45333763cf814fe9c6da69d4b840152e21a4fb9f3f5e2d549a5c71
MD5 e642c5bfdce50da883b5d9b6302c4a82
SHA1 7cb0a8f356857c201fadda38318d5099a2a35eb9
SHA512 6ec0b1155246dd3aebc29f2420e4e3392406efb720be75930c423ae77daa513d4155fc0adc465ec269daf57cc0b3cdb192f3d8155bef1697a08dee0d797615d1
TLSH
T18FB002D5C212E222D04B03B129D5A6D87160DF25D6035B7692E42A66DC25A644535AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 022a8306e2b0f0ea06fef1a222afb2cf7a639920bf0c2d20cca86204bbee2777
MD5 c62102c92ea43f5411f03d38739c30f4
SHA1 b0fc4571f5de8e08fe5fa8b1780a0ebb15be9977
SHA512 2e2d36d7c13f4ad74efa9f361246bdfb9448a7d81182d37b88b9bbfc10e0dddcee31dd61bb4f045e0ceaed6e0fe4c17a83da498e3397e4deb0e9b2b467c0f27c
SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Rm7Rkm1tYpBeh2BAo3
TLSH
T104C3023B5D75A8375DA9BB1EB04E0B1F1EF14AA6CD20DE56C8D85A0433F97CC1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8581d9c4b199a41bd7cebd34f54dc455e70a1badedde66484a3d2847007613e5
MD5 c3c7004e1384975b17c4368561fcb434
SHA1 1f3c237738df96b040aa22db7c363b3c62f5dba3
SHA512 b065e13ee9d03041d55c3b78b92efc984b5d16973fa3e62b515dbd27bf82ba9adbab9586befa639fe2531ec111a19ee2ece86ca2d087c1aa07274ed6a3d677ca
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Jm7Rkm1tYpBeh2BAo3
TLSH
T152C312275E75A9375D79AB4EB08E0B1F1EF14AA6CD30DE92C8D85B0437EA7CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8073c2d121705bb237d74fa53c02a3f6e25e1f8544a5bcc9ec7008d9cb9361d7
MD5 66eba23fdeb0bcc6612c837006aa8008
SHA1 06cdb9a841c09ac6a0fc4c6be3aebfb5f6505919
SHA512 a28d340f14c6140d13d660b0a1eb24838f2eed9f4f061bc116357d7dc5843d4360e749f8b54d838440c7edf17194f19208069835960a84fce09b2e30e5e1f567
SSDEEP 3072:jGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:am7Rkm1tYpBeh2BAo3
TLSH
T195C3122B5DB5A9375DB9BB1EB04E0B1F1DF14AA6CD20DE92C8D45B0433EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a5479c0a02d06a415a9726b09e350a654f84241f5dd325e84f4f02b3809fa050
MD5 10d801aa9c73cf45dfa82ab681508713
SHA1 d6beeb512437c10aa4e9455f1540bf9579d7eb6b
SHA512 c0debd5920dfed8207827aebfd59662aae06358f4c134f3db60934014669fe3ff888d39e54daf12eb5da11000d9ffc282cfa441a62eca6b53b86d3d95b7a59b4
SSDEEP 3072:FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Mm7Rkm1tYpBeh2BAo3
TLSH
T110C3122B5DB5A9375DB9BB1EB04E0B1F1DF14AA6CD20DE52C8D85B0433EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a5f8a6852ac70ffc9892f3ef8e56852ac931ca3018de10ad3daa60d6a303bffc
MD5 b565c164fbd7c139cd5f9a4f68ba6073
SHA1 e058df2eba51c7c84777cb59983b9178a6e9f0a8
SHA512 c4c5cb79d19e915924f9af52a2b30617bc83afdb625e755690d70dcce1507c688d58f42049d4615b2a906445b71f3d2c61be836017a41cc8305e5d2431186390
SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:zm7Rkm1tYpBeh2BAo3
TLSH
T115C3122B5DB5A9375DB9BB1EB04E0B1F1DF14AA6CD20DE52C8D45B0433EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f89d096d4931f102ed0d846cf7c00628e918bf6ece6e67672df102a3827d7001
MD5 df26a001d19a02865f3796364cdc5da9
SHA1 eaa88c3939bdb0b5f62c93b1a8a962eb7578ec6e
SHA512 e881032fa0b755ffaa5bfe96f40ab025af45de1280276abb3fc0c11281f633356a804feb4a4869cda2d7d425bdd5f22b67272724472a7610f8665ca0dfad767b
TLSH
T1D5D012B62A4A7110F2694A31B456CB00776D15A12852A705E22D944CA9A90B562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b29edbac04451c5f28e31033f76e37bc673edae24c89895a83623d117c1e5775
MD5 cf5f264681af3270ebb3c78acf2ec32c
SHA1 865e19cf69ee920a542877c12228ea27edee837c
SHA512 d495c15a319b35402c773c65039360368d65f3d019ec8c0f2ac400597a3c565e4cc0ac7cf168c330084f1066b293a1ccbb3df195b61a4d20b7cc627f0dc8c21b
TLSH
T19BE02B66CC26EC2718FE0728A0198A46E71113173B404D4F3B7C82088FB463645D585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2b71124d359f37d7ce9a6ac2b69e8ade8ade5f775f56cc1568d0ad7496eec79f
MD5 1b96b588ed91ca97cbfad80d1f1df909
SHA1 c493784341720db1219e2e486b280b6751c17eca
SHA512 043b377dce640db8fa0feaa75310a30c45ca042e67e36678be419f2c570eebe3ac66c731d8ef23cf4c5bc0ccb84ba6b3eddc91275bad394ddff32edfdf571037
SSDEEP 192:sxZtRc7ywFXNKOMl8Mi2/fgssQXh9aZdIaRuvTzodpHjHW6+WNGYvIubi8wcIgj3:sxZtaIq2/fgssQXnazIKYIDHbGx0j3
TLSH
T1D1620A06AA28997B9DD7D219F6447F53D2F90133A5905E489AFCCB0C05E77EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d8fe8df06b7cd66c47196dadeaf6cdeba690188add9f48b5a68a921dc870bf9e
MD5 62764d796e85069317eba0e3204f102e
SHA1 02e0c00646d361136feb68dc498564479883786b
SHA512 b8a90f7c775e267306ce03ca7b9940c39e0fce486e880f26bcd57451c5bb827388c519e9f23d4346d48bae962d8d7c057da9300e43e574a518c33eee29cb03d9
SSDEEP 768:ZYsv8OdF6ssi7pLILZFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKysy10LlP:eY8Od/H2ZFhWvFvmXu1jaet10Lm2NuRm
TLSH
T182F2FB3B6C0CCF7A4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 ed5bea5fabbc9eab7b7aae2980ee61aefd4b1d7824854beaab5c0125b12ba5f8
MD5 290b6655694cb45cbad8277ff0f898d8
SHA1 560287c5c7d590e1afce8c72a8116181bb4134c9
SHA512 dce70f4ffd9bfe22c8987a8f4a7f1844adb92f72876d44aa4afe2179481c471daac59c0c7d86f7470e1f8e6c2df3e4f2630ac2da45b7a8db22ff721d55eede72
SSDEEP 192:05ppxnY753RNBvRJJdt7ph5X2lfszlZPePTPiPePYPgPQP2:0LppY93PBZJPtNhp2dsBY
TLSH
T167C28916713A0202397E3948B79696365F4235A33058E8BF7FB810A54F27E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 31fab09bcbc6f6026a66b6d18b7f1a15ab0d3d1efe308155bb6b4b2f537d7263
MD5 5999202b75e4314fc20daf6371b0b240
SHA1 ce2e0506a814fa03dbbfe08d10044aac5d65ac00
SHA512 4f14c05662694484a088d0eb0f45b10b39dab5855b9d80c6b45ebf6454565ad957d3f6a0a9b58ab1992d2c1ce3b8f337cc9f13e41ceee45437d820488c876fa1
SSDEEP 384:nppiF9CcmyWCs3sNQ8TUNTUlIm2QckCr9lrTKphifGG9iOqBNFT60E5pfe4KV8pg:pAFccps3JwgbkUdkFG5gNJ1qI8p0v3
TLSH
T11EB25B36EC58CABBFDEB4F99B74A6A07DEE05167859859D4DADC1E0C009319D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8d2e4daefdb1f9cd39975d78128b58aa8cd906c0e36e75798ae0db9eb2e43ab2
MD5 e955df741e5b937ad932e482f51ae4ec
SHA1 ceefa40e8f872746fb0d656cedf391f4dd46e63d
SHA512 2ca6ea5b103ffbef69acc0c5ab072d6d6bc0086a1a6bea33af84422676cd8c9dedd0c13da8a6ed51652cdb808837ddc25ea9b284329224e2b4ef342d64f9a8d2
SSDEEP 384:nphiF1tNn/s3n9Sk3sNX8TUNTUlI4o5QckCrmrMkphifGG9iOqBNFT6CPg+9KScr:pIF1j+9V3awgnfkGCFG5gNJjPg2K1j2u
TLSH
T170D25C36EC59CEA7FDDA4B99B74A3A97DFE411A388885ED4D5D85D4C00C319C030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3bb68e1de3e1501a274abdbfbc1041d5ed054a550e5a971c77c4820549d1517d
MD5 3bd28e0e735ac6c09eeddcb56769ff7f
SHA1 053f3d57d7da88d8c901a3eec7a0043d703a105a
SHA512 e692563b2d1420021597357294c0fd4b9afe32baba38f9086b4a1a0823ba4a932ea9803a75a21a2e86eba103114f38e4f6a81d00018946a6aaf7411638d6daf5
SSDEEP 384:nphiF9CcmyWCs3sNX8TUNTUlI4/QckCrmrMkphifGG9iOqBNFT6CPg+9KScjmwKe:pIFccps3awgekGCFG5gNJjPg2K1j2e
TLSH
T19AD25C32EC68CEA7FDDA5B99B64A3693DED411A389C88ED4DAD94D0C00D71DC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ea8cffe0bb789eae95331e7c251847886ac1fc16439fe55d1908c5b4a166dcee
MD5 64dbfcb918f9621194a5ea0334101393
SHA1 5ac1196e1933a7072d8615e37c873b1208173bf8
SHA512 2525a4faa882350bfc0e851ce0ebcd5028d74f68334b5453e0799981a3b035fd4396e1a0fee65cdb9769a1bfe7e9a0b136b4f4aa96eeb93c3433bde76a50f762
SSDEEP 768:p7Fccps3qwgbkUivFG5gNJjPgOKI8p0v3:ts384WhbI8p0v3
TLSH
T116C26B32EC68CEBBFCDA5B99B74A3A43DEE05163888C9ED4D6D85E0C009719D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0de0c15-c7a2-433c-aca7-e84242c6e0a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0de0c15-c7a2-433c-aca7-e84242c6e0a4.tmp
Size 28KB
SHA256 e783fa269cb70a5b044b8f220cea814bbef5c54d6814a90c128c5692d019482e
MD5 878e7c64c10a9b9cd1b8477c3794d52b
SHA1 efc01c7e0a67d7fcd0e11a62b1052ba5491c5a97
SHA512 08aaf17101776395e16a0abf86ede436eec00822f8df048d62b7e03a216a4695e67d037f4b9b19c5ab83c6fc8bc56a2993868c2730bad6063864a3a0999cce33
SSDEEP 384:nQiF1tNn/s3n9Sk3sNX8TUNTUlI4o5QckCrmrMkphifGG9iOqBNFT6CPg+9KScjX:rF1j+9V3awgnfkGCFG5gNJjPg2K1j2u
TLSH
T1BED25C32EC59CEA7FDDA4B99B74A3A97DEE411A388885ED4DAD85D4C00C31DC030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4ef88e5a3ef9b7a1eb2adb1519850b0bbcb42b20b4301cf34dcdd39ea096d7d2
MD5 696f00b41cef4c96dd162ed708fddecc
SHA1 32b5a140809be478538b39933ee9ff45e3eeb146
SHA512 269e34b4597cb3b4ba65647592543c58238e2c1e1760996dd8cc4c56aa4cbe37fdfe385db9ce80968b090705cd85ffa46338d5949dd9fc3a99bfd15890a20948
TLSH
T1C5411658B6E91148B3B77F5AAFF7A82E447FB8772F06959D00110E4F0B62A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

7C7C2A7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\7C7C2A7F.ps1
Size 287KB
SHA256 bc300fc879ad3bc5a6be7d17eec6c71f04b4c83da7eca3a7df38368c5e849c8d
MD5 d4c475479d8fe9e5c9646b7ec467841c
SHA1 72efb4169cda1905860f31ff1dbf2636a42b53f8
SHA512 8661197d99b7418fb39240b51ee2daf401ca33518431b2585f173970ef18bda3650e30a11298350a8b87bfd27abb2a171d5e67bbbb6527ace6afa997092d9d55
SSDEEP 6144:RF37842pVzsYw2ogPQeUw3T+QYophtQVx/LBNcTSG2pMas+Hsyw3txosssss8ssu:RFALVznFUeUs/Yobt2/LBNceUdV
TLSH
T1D45412775F0769876D644DC18F0C02D8378D978AA9B49827639F0CC7BB1FA9A020FDA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mskkorhv.f5o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mskkorhv.f5o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

notificacion_32313.html

Path C:\Users\Admin\AppData\Local\Temp\notificacion_32313.html
Size 25KB
SHA256 ec127fa598eb69508010dfadc2135963db6d33e1fdd06cef81c3af4552ebfa7c
MD5 c54c842e5428f1c9ac46f66d2896d530
SHA1 c8dd7768ac16e1bc72e1aceb94ab9ad48e91fe00
SHA512 46303aca59e2e9d4091753349ba456ce690f65be5ce55b3bb1fd437e73e03eedf4dfbb6dacddf731c533132938ec60e8f9ec9a63f94530010d49b014032127f4
SSDEEP 384:YMCE+I1JQXEorEemSUO0WyVGQnrZodmWpFlvXi3OeAJap/0Gw/h9dHTWnJoNe0u:Y0NboQLQWqASvy31AM/0GwRHTWnmNg
TLSH
T11EB2C0B281C80205747EE4F8B072EFCBA0A5E63FD552ABB88C9BE5B5C9C7569D701700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~WRFZJ7wNc.tmp

Path C:\Users\Admin\AppData\Local\Temp\~WRFZJ7wNc.tmp
Size 359KB
SHA256 e1661524a40f871e2c2cfb0502f2501be98df9ac456508a0752f39c6f3916a30
MD5 6c1704ada8f4f2b490caf62d1c2f0dc6
SHA1 db9e5754e39b9ebdc488ab3efde7e854bc7e9a62
SHA512 fe5dfc7b17c5a9d814822f890c07450ef53d0aac0ebdca2d3f0d0d8158fd3d119c40aeadea084d08810e02d7ebe58e1e07cba8f7aaa4f5b066229ece198c6878
SSDEEP 6144:VI4sCUYgxjl5SHsNLtKUwJJaYt3FssssPXssssMsssQh3d+eCgxOuossssskbJzY:i4sCrkjl5rxKlfztm3dxvOtNDRZNOxR1
TLSH
T1BA74D097BC49E3F93CD86FFF08D9315CAF174A00D2A5D821632DCF592B62928474972A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1592-172-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/1592-171-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/4644-134-0x000001A2ED540000-0x000001A2ED5C2000-memory.dmp

Download

memory/4644-170-0x000001A2D5380000-0x000001A2D5388000-memory.dmp

Download

memory/4644-147-0x000001A2ED8E0000-0x000001A2ED9E2000-memory.dmp

Download

memory/4644-145-0x000001A2D5330000-0x000001A2D5352000-memory.dmp

Download

memory/4644-146-0x000001A2D5280000-0x000001A2D5290000-memory.dmp

Download