Analysis
- user interaction
yes - max time kernel
299s - max time network
301s - platform
windows11-21h2_x64 - resource
win11-20260513-es - resource tags
arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
29/07/2026, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
Fsgitmmqw/KJYFJxK.exe
Resource
win11-20260513-es
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
Fsgitmmqw/MovFunXCbozcrT
Resource
win11-20260513-es
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
Fsgitmmqw/qeScClkwFV
Resource
win11-20260513-es
1 signatures
300 seconds
General
- Target Fsgitmmqw/KJYFJxK.exe
- Size 925KB
- Sample260729-crpgmsdf37
- SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
- MD5 0adb9b817f1df7807576c2d7068dd931
- SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
- SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
- SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
- TLSH T101158C0373918062FEA7A5331F5FE7265B7C6D2A0323B52F13981E79B9701B1162E672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 16 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 48 2000 mshta.exe 49 2000 mshta.exe 50 2000 mshta.exe 53 2000 mshta.exe 54 2000 mshta.exe 55 2000 mshta.exe 56 4892 mshta.exe 57 4892 mshta.exe 58 4892 mshta.exe 60 4892 mshta.exe 59 4892 mshta.exe 61 4892 mshta.exe 62 4892 mshta.exe 63 4892 mshta.exe 64 4892 mshta.exe 65 2000 mshta.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJYFJxK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2564 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297652988097870" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" KJYFJxK.exe Key created \Registry\User\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\NotificationData KJYFJxK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000 KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202 KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" KJYFJxK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000 KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3" KJYFJxK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" KJYFJxK.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell KJYFJxK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" KJYFJxK.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\DetalleAdjunto_23.zip:Zone.Identifier chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 4776 chrome.exe 4776 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2312 KJYFJxK.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2312 KJYFJxK.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1568 1224 chrome.exe 82 PID 1224 wrote to memory of 4968 1224 chrome.exe 83 PID 1224 wrote to memory of 2564 1224 chrome.exe 84 PID 1224 wrote to memory of 4968 1224 chrome.exe 83 PID 1224 wrote to memory of 5712 1224 chrome.exe 85 PID 1224 wrote to memory of 5712 1224 chrome.exe 85 PID 1224 wrote to memory of 4616 1224 chrome.exe 86 PID 1224 wrote to memory of 4616 1224 chrome.exe 86 PID 1224 wrote to memory of 4324 1224 chrome.exe 87 PID 1224 wrote to memory of 4324 1224 chrome.exe 87 PID 1224 wrote to memory of 2424 1224 chrome.exe 88 PID 1224 wrote to memory of 2424 1224 chrome.exe 88 PID 1224 wrote to memory of 5536 1224 chrome.exe 91 PID 1224 wrote to memory of 5536 1224 chrome.exe 91 PID 1224 wrote to memory of 3028 1224 chrome.exe 92 PID 1224 wrote to memory of 5056 1224 chrome.exe 95 PID 1224 wrote to memory of 992 1224 chrome.exe 96 PID 1224 wrote to memory of 2868 1224 chrome.exe 97 PID 1224 wrote to memory of 3912 1224 chrome.exe 99 PID 1224 wrote to memory of 3912 1224 chrome.exe 99 PID 1224 wrote to memory of 5892 1224 chrome.exe 100 PID 1224 wrote to memory of 5892 1224 chrome.exe 100 PID 1224 wrote to memory of 3420 1224 chrome.exe 101 PID 1224 wrote to memory of 4776 1224 chrome.exe 102 PID 1224 wrote to memory of 1860 1224 chrome.exe 113 PID 1224 wrote to memory of 1860 1224 chrome.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fsgitmmqw\KJYFJxK.exe"C:\Users\Admin\AppData\Local\Temp\Fsgitmmqw\KJYFJxK.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2312
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- System Location Discovery: System Language Discovery
PID:5284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef133c728,0x7ffef133c734,0x7ffef133c7402⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,1056703919714214197,15868574472755858534,262144 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:22⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,2805187392773507213,6580996043529905577,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2136 /prefetch:112⤵
- System Time Discovery
PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,12710375712484703126,11470438200294074078,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:132⤵PID:5712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,16915153334643071223,16447986141263911230,2097152 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,11648376649232441178,12770449347196247787,2097152 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4348,i,16048794146624634311,9973085708770862092,2097152 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4344 /prefetch:92⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,9628444213676249432,5961072515316806497,2097152 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:12⤵PID:5536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,4965976413249685253,13216638856307725620,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:142⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,5821279439276833383,6920142323346913225,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:142⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,9943239369628724397,16019281869372090463,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:142⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,11916542784708642559,15828830519054855567,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:142⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5904,i,5661292599711060329,5792804506914699628,2097152 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:12⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4876,i,1989469917015115356,4778752466443467577,2097152 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:5892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,15695476169469857180,12426761079989201853,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:142⤵
- NTFS ADS
PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4788,i,6553082350846162667,6107231716514087527,262144 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,9510713622126466655,12000387839642060383,524288 --field-trial-handle=2008,i,6244951301985820262,5608452685398422436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:142⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5364
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2012
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_DetalleAdjunto_23.zip\DetalleAdjunto_08º.HTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:2000
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\DetalleAdjunto_23\DetalleAdjunto_08º.HTA" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:4892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 1KB
- SHA256 02cb0883fe0cd591582be318654f9bbbabaca10e91225189819ba55e5b9be978
- MD5 b6a4a7100ff014ad30b481de075353ea
- SHA1 acc6010445b2293a90a847096815aa1dda4ef8b4
- SHA512 aac4b1c21e063abf0b3a5993a5e34710f7816ed0e47e1e7f24f5ad556349445e789a819e8a27f8f72940ad431cf7cb50b4496f675f97a8458d452c82021ba860
- TLSH T1AA31191ACFB1F951BF815D8A32C9CA3A7DF245C048FE241BA136E0D655103E13F2650C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_8A8FCFA7475BCF55A34EB09CFFE3BE67
- Size 471B
- SHA256 ee4e8fc2a7260ab02dba872a4a4797b37fefb05b4a8624b372825bb7e1a8d4cb
- MD5 c212e3254a1408253cc09cc13fcacd96
- SHA1 00c7cb6cea356594b663a82dde557d641732a125
- SHA512 d84087e87ffb34942cbbfdabeac31ab843e1c363d30cdba11bd6fc85c595fea11fe47049e79927f5a9fe59127a00acabcb773d003eb9ebbafc8f18673b5d8c7f
- TLSH T1DAF0D4445DF4AD45FDC78E043BDC9F3A2530095C592A5E4C237A0B44115FEB55553A15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 410B
- SHA256 296cb7ee24dd0dae39fec389b14eda4c7a0a183b34310789c097f7c94986ca8a
- MD5 61bddcfee9ad4dcccc4158b71eaf2227
- SHA1 790f7cac3fa408dfe26245fe087fc2cae700dc71
- SHA512 b2a70bbc8dedd8d605b48502746297adeada218ddadeb42b6a74cbcc5f2730754d84d8a4c2e942f64402007cd3d89dd89fd9161b2227e1a08c20e256c109f254
- TLSH T1C3E0200439B945BCF431D5394ACE7967176ED319340542F01B948718F747A512D52AB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_8A8FCFA7475BCF55A34EB09CFFE3BE67
- Size 406B
- SHA256 0bf4ffd391456901ec12fde33cbd0749756c28c3fae4bf6ff8e57457a330357d
- MD5 3f2d5720f5f56c0a7d827fbd056e9134
- SHA1 fa905fbd7e82b13e6b741f1ca4b50120166a89a9
- SHA512 0e9dd04d69eddcf482ed3d2d1282cc513ad18ce612dc50581e5c916a13338a6a9a592fd27b1b7d2abb0ccd9f8ed73ace8245daee6639702ba2fa5271f7f096e8
- TLSH T194E026B421AB411CF4A8E4BC4FD6F220856BE216988496B217A1870DA742A43ADA1B38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 f3e708221226b1bc9bbb63b39fd2575e4c81f003c9468d5dc5e7e8f686224372
- MD5 3a60069443ba0432a9820ed0591353f6
- SHA1 fa295da2d9844fe42f940e6d34f23e250c85f39e
- SHA512 f9e4c15e0d37468ef6049b963d5699a229d40f6095fdd36a8823251f121927f0cba515dcacc9b9e3c242269165f4e977a16350b4d37ce822e8a769b82d07de73
- TLSH T102E022EACA21A82B1CFC172C65544E87EA0023666750898F3B3D811A8FB163A8686D1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 1933c92aafaa9af259c0b415dadf41ed6ef8a61eb98c138e5b16926fff236e3b
- MD5 7fb53b280e17a280ba407e1898522843
- SHA1 e53c0385f67b66b798fc4f27f20a0456b1c8eab6
- SHA512 291d7041b8338cb92a8c16e1cdec7f1d60cf63cfd727b7264207a0d87a6562bc33c5bf11e61a2e1f4c449f7c6acb08116540231de2ef02b3f0c8636b2a6714a8
- TLSH T14C51A9F3C3E48A7DC91196F4DB21AE1FCE290A14032C3C5689D4AE5B53E2972D20178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 97720706b6d5442f6934be72766cd6c3e39420bb8efc3806c4cdac31ead175f5
- MD5 27886e5284f299ac434c43cdf45bb990
- SHA1 9859ec2545f80137e7637f1a366e0b2dcd2e07f1
- SHA512 71b4941787875b5a2fb4882b365d36bca91f4dde22fa35d7de1e07daaa3dc7a66a5612f64ea68829dcac736f71395ea956d6ace23db9a6f5bbc930414fd6e7d4
- TLSH T1E071ABF3D3E88A6DC91156F4EB106E2FCE2D0A18022C3C5689D4EE5F53E2972D20168F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 232a8f8296fbf741dfe57b7b54f1131999b28aea7a6b36fd2cc9e6a677ab79d1
- MD5 8659a5d700f5acbc77f13d0a65cab59e
- SHA1 33795d1228626969296ff48d983dcfbaa7e75fa9
- SHA512 f635640c6c61eaf7d701f5b62dc1947b932a54ad87645103b6c5430bff79be7051548f3dfb495b95f931e0d0c1c40bcbccff7f96a11e40b32d16319465a19a54
- SSDEEP 192:GRvl1ledqNkvv7sBILPRp3fM19NHsb+WNndC3MZd4WhW2GpgVyIsnAUgraJ:GRv7On8kXUrwU3Y4Wg2Gae
- TLSH T14B52E86FA914697B6CEBE22AFD117B53E7F0102165C02E84E7FC8A1C15E79CD221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 8961826ed77c35066c198e913c2fd382c0f7f8baa1e2ecb00496ef0f46e3e595
- MD5 c8429fe0c789c727ddf3283bc046741d
- SHA1 f7ee5e45bbdc03a2152b3475dc544460130893ea
- SHA512 6e91c77c90ea6963d1b1a9a7632dfad69ffd9e39c16c74d9ea6caf746f76fd8fb56252ea33c00041015802ad5021019a94dc6e76051a218a8feef312b4822e27
- SSDEEP 192:GRvt1ledqNV1v7sBpAPRp2Z9NHsb+WNnxu0xW2GpgVyIsnAUgtaJ:GRvj7F8UXerwo0w2GC8
- TLSH T1F842F82EBA14687B6CDBD22AFD617B13D7F5202131D12E84D6FC8A1C15EB5CD221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 75f174cb24b3cb487e59a3ab695908d92433d99f9e69f607e99ee38eef32b3dd
- MD5 83fb8cb559096550e0520923dc7dfc0e
- SHA1 c3f7e91d8540c48864a8ca16634b6659f1a9d099
- SHA512 3a428bebe8f76d5650f6ea1c61f8bf786aa0871eba2edc8def35597bb5b66b3dc5586bface7d37a0ae686764b2f79ede57ed7812aa63e8c95b0f7ce102747dfe
- SSDEEP 192:GRvt1ledqN1Ov7sBILPRp3fM1l9NHsb+WNndC3MEg42sW2GpgVyIsnAUgraJ:GRvjXq8kXGrwU3Q42/2Gae
- TLSH T14252D82FA914697B6CDBD22AFD217B53E7F0202165D02E84E7FC8A1C15E75CD221B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 25ce84f46132b9def603d2cc48ea450228aa0d1ac50f0f52ea9c56ad014be32a
- MD5 8cee2cf49279604e011c4226afee6865
- SHA1 5d53f45ab04edb02f607ef2a237d1cc4308124b8
- SHA512 19d565562cc1e203f60c4d37bc8ce2b7d5539498b07bc008276d647560a71b074c813ed568fc69dc962ec065cb36167d63fdbb6281745b8486b536a127a5577e
- SSDEEP 192:GRvt1ledqNQov7sBILPRp3Z9NHsb+WNndChlW2GpgVyIsnAUgraJ:GRvju08kXJrwUh02Gae
- TLSH T13152E82EB914697B6CDBD22AFD217B53D7F0202165D02E84E6FC8A1C15EB5CD231B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 27e221334056a231b7f3e0719bd7ed6a38faa6f41f09695760ada7115dcb16cc
- MD5 c7d85a1a00acbc2a0b42434cc633de79
- SHA1 57341809e412c1ea080e3e4957b9e39fc195c5e8
- SHA512 93e9212fb38d93cac66649178d837a3e086f871db24c1144966ccf40846d5e311792d457ffbb953ca0e33b773dfba11c778bf20bff1e881681da217c7cf057b8
- SSDEEP 192:GRvt1ledqNVrPv7sBhAPRp2Z9NHsb+WNnxu0xW2GpgVyIsnAUgtaJ:GRvj7rH88Xerwo0w2GC8
- TLSH T18742F82EBA14687B6CDBD22AFD617B13D7F5202031D52E84D6FC8A1C19EB5CD221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 41dbc31111a834b5e6cd99601733439129f4394441cf935355149fe00226feb1
- MD5 af3eb44bb31d22139224fd396cac8c6c
- SHA1 1c87cf93b56d7124be5275f12d246874b8721ef7
- SHA512 669d37619d2450517e70ddc736a4b3fedb56cd9a2fc5e9f2e0b4f928ca75284ada0e5021d6a0232bd663f58757651ca2332b65f26613b8876030250bf90a74ca
- SSDEEP 192:GRvt1ledqNKxv7sBIAPRp2Z9NHsb+WNndChyW2GpsVyIsnAUgraJ:GRvjYh8JXerwUhd2Gue
- TLSH T15242F82EBA14697B6CDBD22AFD217B43E7F1202125C12E84E6FC8A1C15E75CD231B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 aecdd429725891f40f906be345ba9849f78972c9563b2825cc4f733634426ceb
- MD5 84c26d7f5aa20beec8feb55996c82798
- SHA1 a67dc9e5a5234c4ee8f7e51526f8981cc9a28603
- SHA512 bfc45b3f213beaa5ed87a40cf17f2aaec2cd0db47939db777f6f74347d9599bb70996e849abd1b90a74a4bcc102836fe0f387f10333b75f0b49790dd042fbff5
- SSDEEP 192:GRvt1ledqNkov7sBILPRp3Z9NHsb+WNndChlW2GpgVyIsnAUgraJ:GRvj208kXJrwUh02Gae
- TLSH T17B52E72EB914697B6CDBD22AFD217B53E7F4202165D02E84E6FC8A1C15E75CD221B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 219db7acf380c142a244fd11d2def059b6c8fc454e0d1f267f3170f83d8f20f4
- MD5 6829413167491e65583f4bbd120f3ba3
- SHA1 13fcd5864497cf2d1561d82a3f2afb41116cd9c8
- SHA512 22c4813d0f7309f4d63bde121919cb6b4ab623c4dc8b048501dd9e934dd890260eee5efc595875026c6ca72c540a8f457811ca6bb99d7796439ae3ae6485c3e1
- SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLILc2j5EXODtw+ErU3UlH14wnTGv:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pg
- TLSH T1EF72F9A76C4C8E770F94CACCD817BB4FADB5024B65E9C86447FA581903D5BCB110A1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 cf427e359da8a7c78a0f04c03cb32118a84141d9ea7ad8e0591975e6aec7c7f5
- MD5 d19179093dbbe548ff55efc70983580a
- SHA1 01b7d2832ddcfe8d1644c6f93865e5bfd24babb1
- SHA512 ea058df4b978b6b2ba1cd5b96a93f3ad771c3cdc51215e1c08a0b33a859f86b75350aff9e01432ec553d1b550feed546fbbce38db7759d168bb7022c56c260ad
- TLSH T119B01205C0016502C44207B021465488B1185F109E0E270183F06D22C8391618018091
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4874.TMP
- Size 96B
- SHA256 418def8ae2ab7a9aaec2e81b46448ba39488fba5e7c9bd2273d6dcfe77547714
- MD5 b6c0afc91fae2c26a0122dd7044221ad
- SHA1 997f09cda242178d07c4e3a081167857c147daa3
- SHA512 94eb6d50ab19b288779bff81381e689963aa6db725b4bf44e7bc9bf91dff238954e62728d0acca66b7507fad0b4fa84f32daed76cee671e61b72f5eb8a800cc0
- TLSH T180B02222C20232A2C80203F820C0A2CC3020CF20C20B020282E00E32FC2023000200A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 411844606ba3084a8bb9ad21856ec668608a2abca0255d0b7e60294f13887871
- MD5 edd8bb0bfbed30b4cc97f83bcde86023
- SHA1 c87c15d8edd33902ea60c64fa7b6b905b59c44a4
- SHA512 3861c00c05abb21b3a7694b9bf6ade4fbb02644ec6a40e12975acf927ad1fc5e39aaede7fd00ad5f40b9a720dd8fed6abd03c6f542e98d15d802e94fa4d427ec
- SSDEEP 3072:IGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:jm7Rkm1tYpBeh2BAoe
- TLSH T1EFC3122B5E75A9775DB5BB0EB08E0B1F1EF14EA6C920DE82C8D85B0437E97CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 ed194b160e90d3b158782eed793f53f06757c13f12b6bdfa4c8fb0f902a71323
- MD5 b166fefd3fcaa20033759b5c61ce46fa
- SHA1 5463d3c66eb0f94d4648e43a025ec8f20595460e
- SHA512 c82f206e43adf6f2813d3586dfc197c11b2d8283192e7e899fd69ffc9ba2050a43a05336d840970ad794c4d314ca0099012b541fd99c04bfe1919e71b0b89032
- SSDEEP 6144:yuQyzf+QxkSReM3MP+m0AIWqy8m7Rkm1tYpBeh2BAoZ:yuVm4sLVd9oBGcAoZ
- TLSH T1DE3412371EB7A8368CB4D35E708E5B4E1EF155A3E9148EC79ECC0E0567A55CC6B0B828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 bcb7fd6b838e18706861646d4e632e7f48abf9a359b064fa1c1d1cf6a60538ca
- MD5 9c7211f42d311f2a6ed2b214ef527450
- SHA1 595962c49141ac73a13e3a9407b7ba4425285a49
- SHA512 5fc5f298922a83571d094595887bb186c2fb7700dad1a5573f7d388833f7b3ae85dbb41fd1e2c730e75c7cc4c6ca4768baffb41f7fe58f93b2901517c9a972fd
- SSDEEP 6144:YuQyzf+QxkSReM3MP+m0AIWqy8m7Rkm1tYpBeh2BAoZ:YuVm4sLVd9oBGcAoZ
- TLSH T12A3412271EB7A8369CA4D35E608E5F4E1AF115E3E9144ED7CAC80E0577A55CC6B0B838
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 dccff861fd91109419b3f3ceca2a4a9261dfcf2ca8622782fcc6079817a4e6e7
- MD5 8aadd67017b12583f4dc49fe7acfd3d4
- SHA1 40465ee5eddb3109b53b6ffd2f80e6d5dbf24a34
- SHA512 b4f194c5bcab85d25447fe76f7aa6d5c375cc459988cd6d708e7a4f68c1482b4c8292c6df16d4f6ccfff2cf32fe1d9287b6505d318f3c67be5b6e782b0106555
- SSDEEP 6144:/uQyzf+QxkSReM3MP+m0AIWqy8m7Rkm1tYpBeh2BAoZ:/uVm4sLVd9oBGcAoZ
- TLSH T17C3412271EB7A8369CA4D35E608E5F4E2AF115E3E9144ED7CBC80E0577A55CC6B0B838
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\DetalleAdjunto_23.zip:Zone.Identifier
- Size 81B
- SHA256 a130529c8bdaa91c8c48106dc027b96e290e53e9ed9399ce4b72dc31fda5bfad
- MD5 68a82891f2cd5815cad090253c640a59
- SHA1 881dc0093654327d46ca20228d22153a51cdd18b
- SHA512 079498f6e0cb5643694f9282b56a157a440ecb6fe5a220b36b1df68a638b54d9a5d6cd1b86857f53e7df6c0fc09db1bb05e41eec931547a0f8ee7668b6e97e0f
- TLSH T1C1A0241F0500C04C05D431C000CC403C710D74014D4547DCFF0404C7CC4044C75F4001
- MD5 SHA1 SHA512 TLSH