evolutionrat | 37b14c3ec6e804a213fd42ea71a3426c907f3cdf8af590cc3c8a24e2eb44f2a8

Analysis

user interaction
yes
max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
29/09/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
desarchivo-2473539_Edicto.xhtml
Size 6.9MB
Sample260929-qy4rss1erd
SHA256 37b14c3ec6e804a213fd42ea71a3426c907f3cdf8af590cc3c8a24e2eb44f2a8
MD5 46874c38e186f0ff6124bca5d9ecd8ca
SHA1 2c29bcb96ac3bbcfadac6508fa1516491e29f644
SHA512 6ace862d8c88f6c3dd6856be875c071624cf83957842bf4ac221f3108efc6c587466be757711d0e3a0a478f9e5316a9f9785296c358b4c57be5c619cba2df484
SSDEEP 24576:CvR1uPTHObSFII+wunJcNXMOGWyVX9PtEeNUdOyZmbm/P1x4XJjAshbsS7Rjpwzo:E6PTHmSFIIH2
TLSH
T1E976AEF5B504BDE5A76F532BD5A96E8903741733898EE9CC407877C30A63362FE0A849
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution evolutionrat persistence privilege_escalation rat

Malware Config

Extracted

Family

evolutionrat

snipervps.duckdns.org:1010

Attributes

install
false

Signatures

Family: EvolutionRAT
EvolutionRAT is a Windows RAT written in C.
rat evolutionrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3356	powershell.exe
4044	powershell.exe
2468	powershell.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SvcShieldZdsL36.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SvcShieldZdsL36.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SvcShieldZdsL36.vbs	wscript.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5524	WScript.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3356 set thread context of 1388	3356	powershell.exe	165

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3812	cmd.exe
2876	cmd.exe
5484	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5484	cmd.exe
1652	PING.EXE
3812	cmd.exe
4316	PING.EXE
2876	cmd.exe
5676	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	msedge.exe
4660	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	chrome.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1652	PING.EXE
4316	PING.EXE
5676	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
4308	chrome.exe
4308	chrome.exe
4044	powershell.exe
4044	powershell.exe
4044	powershell.exe
2468	powershell.exe
2468	powershell.exe
2468	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1388	RegSvcs.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe
Token: SeShutdownPrivilege	2200	chrome.exe
Token: SeCreatePagefilePrivilege	2200	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 900	2200	chrome.exe	86
PID 2200 wrote to memory of 4660	2200	chrome.exe	87
PID 2200 wrote to memory of 4668	2200	chrome.exe	88
PID 2200 wrote to memory of 4668	2200	chrome.exe	88
PID 2200 wrote to memory of 4960	2200	chrome.exe	89
PID 2200 wrote to memory of 4960	2200	chrome.exe	89
PID 2200 wrote to memory of 4736	2200	chrome.exe	91
PID 2200 wrote to memory of 2028	2200	chrome.exe	92
PID 2200 wrote to memory of 4736	2200	chrome.exe	91
PID 2200 wrote to memory of 2028	2200	chrome.exe	92
PID 2200 wrote to memory of 408	2200	chrome.exe	93
PID 2200 wrote to memory of 408	2200	chrome.exe	93
PID 2200 wrote to memory of 2696	2200	chrome.exe	101
PID 2200 wrote to memory of 5736	2200	chrome.exe	106
PID 2200 wrote to memory of 5736	2200	chrome.exe	106
PID 2200 wrote to memory of 3904	2200	chrome.exe	110
PID 2200 wrote to memory of 2844	2200	chrome.exe	114
PID 2200 wrote to memory of 5740	2200	chrome.exe	115
PID 2200 wrote to memory of 3388	2200	chrome.exe	116
PID 2200 wrote to memory of 2508	2200	chrome.exe	130
PID 2200 wrote to memory of 2508	2200	chrome.exe	130
PID 2200 wrote to memory of 4948	2200	chrome.exe	131
PID 2200 wrote to memory of 4948	2200	chrome.exe	131
PID 2200 wrote to memory of 5352	2200	chrome.exe	132
PID 2200 wrote to memory of 5352	2200	chrome.exe	132
PID 2200 wrote to memory of 1736	2200	chrome.exe	134
PID 2200 wrote to memory of 1736	2200	chrome.exe	134
PID 5524 wrote to memory of 6104	5524	WScript.exe	135
PID 5524 wrote to memory of 5484	5524	WScript.exe	136
PID 6104 wrote to memory of 1168	6104	wscript.exe	138
PID 5484 wrote to memory of 1652	5484	cmd.exe	139
PID 6104 wrote to memory of 3356	6104	wscript.exe	140
PID 1168 wrote to memory of 3240	1168	msedge.exe	141
PID 1168 wrote to memory of 4796	1168	msedge.exe	143
PID 1168 wrote to memory of 2220	1168	msedge.exe	144
PID 1168 wrote to memory of 4796	1168	msedge.exe	143
PID 1168 wrote to memory of 4796	1168	msedge.exe	143
PID 1168 wrote to memory of 2216	1168	msedge.exe	145
PID 1168 wrote to memory of 2216	1168	msedge.exe	145
PID 1168 wrote to memory of 5416	1168	msedge.exe	146
PID 1168 wrote to memory of 5416	1168	msedge.exe	146
PID 1168 wrote to memory of 5416	1168	msedge.exe	146
PID 1168 wrote to memory of 208	1168	msedge.exe	147
PID 1168 wrote to memory of 208	1168	msedge.exe	147
PID 1168 wrote to memory of 208	1168	msedge.exe	147
PID 2200 wrote to memory of 4308	2200	chrome.exe	151
PID 5608 wrote to memory of 4500	5608	WScript.exe	152
PID 5608 wrote to memory of 3812	5608	WScript.exe	153
PID 4500 wrote to memory of 4092	4500	wscript.exe	155
PID 1168 wrote to memory of 6004	1168	msedge.exe	156
PID 1168 wrote to memory of 6004	1168	msedge.exe	156
PID 1168 wrote to memory of 6004	1168	msedge.exe	156
PID 3356 wrote to memory of 3988	3356	powershell.exe	157
PID 4500 wrote to memory of 4044	4500	wscript.exe	158
PID 3812 wrote to memory of 4316	3812	cmd.exe	159
PID 1240 wrote to memory of 3068	1240	WScript.exe	161
PID 3988 wrote to memory of 2572	3988	csc.exe	162
PID 1240 wrote to memory of 2876	1240	WScript.exe	163
PID 3356 wrote to memory of 1388	3356	powershell.exe	165
PID 3356 wrote to memory of 1388	3356	powershell.exe	165
PID 3356 wrote to memory of 1388	3356	powershell.exe	165
PID 3356 wrote to memory of 1388	3356	powershell.exe	165
PID 2876 wrote to memory of 5676	2876	cmd.exe	166
PID 3356 wrote to memory of 1388	3356	powershell.exe	165

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\desarchivo-2473539_Edicto.xhtml
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8a07c728,0x7ffd8a07c734,0x7ffd8a07c740
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,2346293707079558122,4515482248859911337,524288 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,12417277466478380701,13681487110543519974,262144 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,15579150428301711370,14238587075610489713,524288 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,12979239779751411606,6925931860870147606,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,5495826770268071237,15836363597173322779,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,328971044704138968,13820715371942686278,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,9922964152897597577,15397119700709006529,524288 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5640,i,5175604394536846689,2748284359341621682,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,8161446635077683378,13575979984862564834,524288 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,246338239045891150,12769274369691803655,524288 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,10746393741974514928,3736157837947246970,524288 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,16954089871246646959,13209416455043226564,524288 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6020,i,5518828645267652918,11027182882474827062,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5832,i,2118909610004831963,13731289585220833942,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6256,i,9581899519669364176,6639889251407435476,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=2404,i,6909385501364767003,16150222444544140725,2097152 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4432,i,17485698161615351454,6805532728238405828,262144 --field-trial-handle=2156,i,13502003123810176411,3742658158755122669,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1912

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Demanda_Civil_Reparacion_DaÃ±o_Patrimonial_NUM67435\Demanda_Civil_Reparacion_Da├▒o_Patrimonial_NUM67435.js"
1⤵
- Checks computer location settings
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFRv0PGZu5lw.tmp"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\notificacion_53974.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffd72acc188,0x7ffd72acc194,0x7ffd72acc1a0
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,14140483924888161795,12356839281054482290,262144 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,12599628439242527145,1603505898683990925,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
      4⤵
      System Time Discovery
      PID:2220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,15315700896062178124,4072364424416100176,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,6825457533816881675,1324099080343088505,2097152 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,4379208278377273187,12443146056938106886,2097152 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,15778518998500440551,6022625624374119116,2097152 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,2347426055414283709,7519903537998189386,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,17617311281042982154,11692936929914983993,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10395050934145912319,11966332150539600882,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,16711383039434694928,2192849576018361551,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,7648327641141226510,10692522623896645598,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,14284881411436931756,17561306011211303878,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,14284881411436931756,17561306011211303878,524288 --field-trial-handle=2156,i,6873349716977007879,5161325760848488069,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
      4⤵
      PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -NoLogo -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\5D2F2A7F.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\plyafsf0\plyafsf0.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD10D.tmp" "c:\Users\Admin\AppData\Local\Temp\plyafsf0\CSC3E2843269BCA4D2EA22FAA7E4C121A25.TMP"
        5⤵
        
        PID:2572
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:1388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 4 > nul & del /f /q "C:\Users\Admin\Downloads\Demanda_Civil_Reparacion_DaÃ±o_Patrimonial_NUM67435\Demanda_Civil_Reparacion_Da├▒o_Patrimonial_NUM67435.js"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Demanda_Civil_Reparacion_DaÃ±o_Patrimonial_NUM67435\Demanda_Civil_Reparacion_Da├▒o_Patrimonial_NUM67435.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFRv0PGZu5lw.tmp"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\notificacion_53974.html
    3⤵
    PID:4092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -NoLogo -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\61E4AA7F.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4044
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1cfhey3p\1cfhey3p.cmdline"
      4⤵
      PID:2592
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF696.tmp" "c:\Users\Admin\AppData\Local\Temp\1cfhey3p\CSC7D6F67AEA8A349008E5AB967A8296579.TMP"
        5⤵
        
        PID:3480
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 4 > nul & del /f /q "C:\Users\Admin\Downloads\Demanda_Civil_Reparacion_DaÃ±o_Patrimonial_NUM67435\Demanda_Civil_Reparacion_Da├▒o_Patrimonial_NUM67435.js"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4316

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Demanda_Civil_Reparacion_DaÃ±o_Patrimonial_NUM67435\Demanda_Civil_Reparacion_Da├▒o_Patrimonial_NUM67435.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\\~WRFRv0PGZu5lw.tmp"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\notificacion_53974.html
    3⤵
    PID:5548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -NoLogo -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\2FBBAA7F.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2468
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ed12dm5m\ed12dm5m.cmdline"
      4⤵
      PID:1692
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B.tmp" "c:\Users\Admin\AppData\Local\Temp\ed12dm5m\CSCFD52110BE9E64C68BEEA2C2430FCE7A.TMP"
        5⤵
        
        PID:4224
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:5656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 4 > nul & del /f /q "C:\Users\Admin\Downloads\Demanda_Civil_Reparacion_DaÃ±o_Patrimonial_NUM67435\Demanda_Civil_Reparacion_Da├▒o_Patrimonial_NUM67435.js"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5676

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Downloads\Demanda_Civil_Reparacion_DaÃ±o_Patrimonial_NUM67435\Demanda_Civil_Reparacion_Da├▒o_Patrimonial_NUM67435.js
1⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

892d4ab6-c562-4346-aca8-ce79872f21f9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\892d4ab6-c562-4346-aca8-ce79872f21f9.tmp
Size 131KB
SHA256 18d3be281582cfa7f781a50a46ceb6be3ff612a31a1e68fea98155fbf1974cf8
MD5 188f5c276b8d95e89730b97b022ca1db
SHA1 a95a4f22d3cde334d2c5088c0352ed724ba44c89
SHA512 93dedb358812b38965d7fe48b1af55db7fd29b3445b70a62bfe4d072ae21c445e548bc56837b93ccba59b77abf1d47dc426226f3e467da266ad4f56eac67e84e
SSDEEP 3072:Xh5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Xh5+hFD+7t56OD9ZfSApprB
TLSH
T1CCD30232AA95D8B789FC7541A187A304CEB66CED45DE3A0944465F8E909F94C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8c010677af14063fcb19300aa9c5560cb571ebec54ef550ec292d3fd2e9e4085
MD5 2825efbd0d0489cf1c1501c69f449083
SHA1 8c37ceb2915c0657bb6eda987c355ba62e99a1a3
SHA512 185dbd99eb311a247910a87b9a2131389cc6b97e9d5ae92fd641065e3d638915955fcfc75ba3a452156b8c246f7d07ee7a93194e3e6f5243182496d652c40a02
TLSH
T11DF0F9B6C921BC7B28FD5B2D20544B47EB4513173680895F3A3D420D8F74977858581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 dfedff8c7d1c22be9134d933f42e3bb28793d709bedc856ef3702c7873bcee70
MD5 d8e3a9e83b85f815bc6077064f7153a0
SHA1 1e05d0edc8f85d659fdad79089579fbb14357f07
SHA512 60c8722b1ac0b2b620520775d029c1596678c4b03b1135d083526a54d0aeb8842abfbc3676b489f0aa9242433db6fd6f2c53f55350d6d2d0cf279f31064bab4e
SSDEEP 96:m00g86YK23g36ozfHHcRnbD3jKEbvF8gCZ3W4Dqmq1LANLsDChwJqlswc+gMn59g:mTVKOlozHnIPF4uB1LkLsY2qlswDslN
TLSH
T140F13008A575C09ACBA637FBC5CBA03DB3FA25604A539E9843DC19797D393F921C492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c0c678513983106418ae92483586704125e8112e3ef02fa0417f78c490a33e6f
MD5 4964f1ee9d513ddfd08e112d03f4fb92
SHA1 14d95ba85df290c8feea46e383a548ff4d9bc9a9
SHA512 ddf42f70c170cb0b999384812182b1004604b9214197d67cf9824e0e6aa5bba03ea28649edbeded3a5f2a23064919c25d6398f8afc2fec863cfe78a2c28f5ed8
SSDEEP 192:DoIvQ7XE4CN+za2VcknEBYzDrNP3aP96/ItIsq5uQIjhnZ:DoIvQ7XE4CN+za2KknEBYzDrNfaV6/Ih
TLSH
T157F17DF7C3D8C62DD91156F8A7166F1FCE290928432C3C27C8E8AE5B93E2871D25465E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 630f5229a0445c80d5f4704785751a203ce973a07284c140ba70b75dabdcb56b
MD5 b8ef3153f8891053503043a08fe62f82
SHA1 401cdb2f6cc9809e3d616cb06dc4cd602f46e6a1
SHA512 a35de3ac35ccb54ac795e9a2c95c7f693ef0768648e84573b3dfd9ede2fe5c2661eb28b415495325a08ab9695ffb77775e23acc8540a2cd9adc20d29f54e6415
TLSH
T10E517DF7C3D8867DC90196F4A7256F1BCE6A0A14532C3C56C8E8AE5F53E28B2D34058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1c6a8f5aaf07159f5ec6f91184832dd90a884d31125e198add3a0f907632d52d
MD5 393ab81877ec722200622d6c9a77deaa
SHA1 eba27abdabb4b31031192b6a6dcda95204c2e027
SHA512 2fabb8a4e6cba01e3a871d9dfb9242f56283229533cd18264f2b0fd719e38911a89f60d70f4d596db966439d9c50e301f1c86274b49e1f62cf41b6269e7bbf7e
TLSH
T1C1517DF7C3D8867DC90196F4A7256F1BCE6A0A14532C3C56C8E8AE5F53E28B2D34058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0e6209a596619e461a482428a26ce167dcb9c111123da83688f479c8be129654
MD5 c48f43b1d5c75a9ee03dd28432d5e25d
SHA1 9dc21f60126e433207f8a8759b11b6bda4dd76e5
SHA512 08459795abf8ec26a4597915a4b020794a4416725ebda949b89f3158c24a99267370a4b1088958d8f0f3189c900374626de464a3c12ebd739c7e04da67c81493
SSDEEP 192:hRBBn10LxMD6pev7GpAPRp2Yf96Hsb+WNneyPP82FMMkwAYeVyIsnAUge:hRBBnMzpaCUXpsw5PE2F5gHe
TLSH
T12E42932EBE10787B9CDBC22AFA217756D7F5102624943E84EAFC893C11E75CC622B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d1752e12c58bfd988b6fa03c200545c63a841026ab4c3a2bba7e10849146183
MD5 8f528f7289c38c4279c154b5dc01902d
SHA1 1c7294ff4ddfcb058a93827b95517d5799c87457
SHA512 6fdc1017d5fc2864f464ec05509cd2c3a0c0c8818b88a786f95d8db6ef07dbf6e3fd07c4fe29229976cdf533a296141a99cd0cb4fbc80f3672916e640479a6bd
SSDEEP 192:hRBBD10LxMD6pgv7GpAPRp2Yf96Hsb+WNneyPP82FMMkwAYeVyIsnAUge:hRBBDMzp8CUXpsw5PE2F5gHe
TLSH
T19542922EBE10787B9CCBC22AFA217756D7F5102624843E84EAFC893C11E75CC622B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 99745597d52905ef7eec35c3467d90a8129bcf899a1980181c5b78e98bf66a00
MD5 1cc76eff3c510ee1c5057c13ff56765c
SHA1 81e283d0579cce2fe9fc96e607b5ebf0542bd83d
SHA512 add9db52451b48e16030a2c4db48367bb27c4ce904ab69901403bc3556026e8835927f37c84d72fce147bed34607b2afcf50155aa5b24f55410362738ffa64e8
SSDEEP 192:MRB9cBzD10LxMD6ugv7Gp2PRpMDFvqd96Hsb+WN0Dpv4/72g82FMMkwAYp8yIsn7:MRB9mzDMzu8CmXrswwE2R2F5gLvU
TLSH
T1E952B42AFD1039BBACD7C22AFA11776AD7F5102624943E88E6FC893C10D76CC621B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 db992682948f89172edb96a1f446d07e553e6e88e4eb305e6d976e416a402a14
MD5 b190ff75c2553196e36c57d8407194ba
SHA1 b1b8dc017472e0d76809bc73685f13447fae94c7
SHA512 efefbe15fde10157025418c1c62690ebb3358dfa9814a2eda7fad25b8d4fdb5938e11839deea8db6de187325ad0c2679052410debd8ef96d00539729c4178afa
SSDEEP 192:MRBBD10LxMD6ugv7Gp2PRpMD93w96Hsb+WNnpv4/72g82FMMkwAYpVyIsnAUgE:MRBBDMzu8CmXHswZE2R2F5gcE
TLSH
T1E552A32AFD10397BACC7D22AF911775AD7F5102624943E88E6FC893C11E7ACC621B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cc902c141ac2de9d6225b0424b28c4b9877b3bdc949f136b527a96678ad03f02
MD5 d1ffbaa47fac5840fb59d6de79a77549
SHA1 880ed9902f3cf4fb86eb09408d84f8f7c0963c30
SHA512 7e5ce3dd6645bdfa6ae44bbc71fb0af7efd81c5d6d672a6db6e068eb3575b5820aa18be2b2bf694ffa0b72acec54a5bde0c5146f08af926c00083660c5d34d6a
SSDEEP 192:MRB9cBzD4w0LxMD6uCv7Gp2PRpMDFvqd96Hsb+WN0DpvJxd4c//72S82FMMkwAYB:MRB9mzDazuOCmXrsww54c2r2F5gLvU
TLSH
T18D52A42AFD1039BBACD7C22AF951775AD7F5202624943E88E6FC893C10E7ACC6217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4258cd18d89ff7fc6593e04a08bba77c50b6c29ac674d340d6da092d9ec25f83
MD5 ca0b1ff79fa0a495c36541562038990c
SHA1 344f537b5997511ebb076221811f99b936ffb5f7
SHA512 9f48ee4807f10bd41e5de2247f648346013d2f31e00468b55dcf48347b8c3c8d799b49c10b232aafec38d607fe261b9e4c8dea80b5d8eb8fbfd352d862f443c1
SSDEEP 192:MRB9cBzD4w0LxMD6ujv7Gp2PRpMDFvqd96Hsb+WN0DpvJgg+/72T82FMMkwAYp8A:MRB9mzDazubCmXrsww92242F5gLvU
TLSH
T16F52B42AFD2039BB6CD7C22AF911776AD7F5102624943E88E6FC893C10D7ACC6217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 cf0a0518159c81347b2da9a962fd88616c2d374cf7afcc698181c5269962c1d4
MD5 e1c95e2a293fa8207dc28783c747d0f9
SHA1 c9c630bd7261f738276e1af76d19d72f05f1188c
SHA512 e6aefed6ff952175e2a84e058ff98801b0d6388c100fdf8fcbe41694b87efea6c80859db1959eecbcb56cff6f19edbf81376cb6486276adf2b73772667cdb039
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLILcCSzyjDXODRyjr+ErU3JpH1Y:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pS
TLSH
T12772F977BC4C9A7B0FD4C68CC8277E4FADB5024B65D9C86443FA983903D4ADA150A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7980657072db1672b008327a7093bd94276eafc43bccf76d2dbaaa797d1b3e6d
MD5 07d10a9429101df0d2157a9f7d9cce5f
SHA1 fcad0bc244abaaca10ccebdeeb5e982bc627da5a
SHA512 680f434060acf06d4d4990c8c44f0522118bd184b936a464f594d1b44a8ba62a00e118687ece82742e0a9994aa810328d8d446d5ac72a3fa28f18a46f1858eee
TLSH
T193B0125580413301C15103B0115090747370AF34D113238542E00D029876290915760D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593697.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593697.TMP
Size 96B
SHA256 574642b80736f4c550acca689a7dc5558c98db1b15af46f09a07b6a70b92ad74
MD5 c2228be6837a51c684447646431a062f
SHA1 9c89a8d866e7253f8538dc047f8c8cb19085682a
SHA512 6104e4942ea5be46d46af7d2718e2de5d066a4862583cf8cbaf8605dc9ab1a304c0ed0e3070fb9105ac83847bae1fcc45df2252a7df02bbcfa5d64ceb1c9b811
TLSH
T175B011A080023202C00203B0288280A830E08F30820F220282E00AA2E8A22208020822
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 3a699be594f1a5edcec1bc722f577d50c10eb3f7e3c43134d0bb84974b6ea63b
MD5 73caa3f1843b59f60026522460c7dc38
SHA1 2791c73cf7a840772ca3e7cea94b40a416c3e154
SHA512 e7c76907ab70609c60382c67530ea81255043a2cd3e32f61adfada09de2085c452b1159f3d22467f00e8a651f6de0695e2e9ae5d28181c761867b98dc7a41a8c
TLSH
T1D1B024D010010C17D5C007F173D30C4033F1DF5003C74171D1F040007403115030151C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 0684f0caffd478d4e73e68e98aa7f5ec4fbba9c47cfbc1db58654f499621a451
MD5 ebacb0c475f2cac946973223b4992f7f
SHA1 8d6fd3678d41164fcb4f988fccd24720ccf1669a
SHA512 bb6ff062ae26c1250969b3ab0948176921ef31c8c3b4ca1ee7368ee454cc33f065f0059695b61a971ce4d7f00b07474d157e322cee43981784973261a8fcc569
SSDEEP 3072:UK+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UK+hFD+7t56OD9ZfSApprB
TLSH
T17DD31232AA91D8BBC9BC6141B157A300CE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 62e2d495202c2cedc7263fa9d1e185c565073e77b1017d5e95d1a5b8ebdda512
MD5 86def6fe0aba437cf1550259924f4fe6
SHA1 ca6b7c39799f70f113e5a91139ed86dfc1bb9d54
SHA512 5442129498d18cf6cc236ba22c6adfcd4a028af50bf93ea9764b7399da65ac0eb454d0f743c83871d68c995c64537577fbe56d8d0776976fd57895e80bf37887
SSDEEP 3072:Ux+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Ux+hFD+7t56OD9ZfSApprB
TLSH
T1F9D31232AA95D8B7C9FD6141B187A300CE756CED45DE3A0944465F8E909FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 b4d696ff61ed714dba49ee8290431a9e1d245801d8456c05ad71a01477aa7dde
MD5 f3c560ef2e851630cc9b6f5515034a6c
SHA1 a4ec4982b61d0755a8c0893dd51f835e83bb7804
SHA512 23ae5bc20230da3b13285a8578d2686c50d8809487de7f2c751af95fdafa0f4ab039c60ca033b91d4172aff2fed7bc3662d702f1f70c7b39cb95746e59171ce0
SSDEEP 3072:X5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:X5+hFD+7t56OD9ZfSApprB
TLSH
T1A6D31232AA95D8BB89FC6141B147A300CDB6ACED45DE3A0944865F8E909FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 153KB
SHA256 fe12580c3bf461bf9028ede3a6ab24fc20db8fcb77c2c96f4998e94fda768fe3
MD5 5fbd03e88e56e6bc670e8d79094efde5
SHA1 819c34c553f4352645ca5ea802d995bfb420c28e
SHA512 965895c23b9c3b2ae2efcff76218400b42b46e3d9e235ae9a2f0bdfaf7337a06966b27764fc4241db2940b333b6313f48ceeeb92d037d3ba9df217b75779c172
SSDEEP 3072:XwoHN6Y1+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:X5N/1+hFD+7t56OD9ZfSApprB
TLSH
T1C0F3122669819C77CDFC7241F247A304DE72ACFE55D63A0A44964F8D909EC8D07A2E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 c610d72476a568e954b357b1fad01e0d36dd66233adbeade68467f14e038cec3
MD5 221038633ede8b88ba9ae1efa82f0649
SHA1 1cf08828545a078b4f291f6792f69bd5aa91f5fd
SHA512 6d5c20f80b7b7df6e048c20fb89fb4f1fe85908bd64efa23cce5436b354d6438c014623c87ab2e9c887c2b0304636b8463128e55080a0e98fc715314694e439e
SSDEEP 3072:XWN+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:XWN+hFD+7t56OD9ZfSApprB
TLSH
T1D8D30232AA95D8B789FC7541A147A304CEB66CED45DE3A0944465F8E909F94C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 39716620a3e007147e74f56190a6d40817b7b65760e51f4d601ac1d0766c39d2
MD5 3a1111810a8d52f2b175d1f8a9be270b
SHA1 f6b426c42968a47f69508dc25b0ba319240d0334
SHA512 d362ba7adf377f23457d5540eb103a382e411d76626876c63fc05e1416e53ac6d2b77cb1770ef431cd8f17d326c488335f98baba99cf783cfa0fe66882d50498
SSDEEP 3072:Xx+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Xx+hFD+7t56OD9ZfSApprB
TLSH
T166D31232AA95D8B7C9FD6141B147A300CE75ACED45DE3A0944465F8E909FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 853fa69aace8e639d8917a9879b7d3c4cba800df97b423cc2656a7fd34ca4d20
MD5 632232532963079c064ddd5f9eac9753
SHA1 b17d6415a4f16622b574809b72d9399223a97e40
SHA512 ff8ce47df85fc894e68d56b7f43a5b563cb4bb0b3fb30b07454a05955ddeb4791ea8178c2030c917dd5c729576fc5451f7afffe77bee9763d7ee50959593cb33
TLSH
T1E0D02B20B2A87754E006343C0114428C30CE5570140BB400805413941FC163201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 03688ef2b70ccfba3243aaa6683b7e3b6b5a9dc0bd77fe1569f40c1a29a672ee
MD5 9a08563a5539084d3215d68793d9bf6d
SHA1 9856b25f391091024611cafca2264304fdd729a4
SHA512 5fbbbb53d75c02b5b45655f65601885c6a985da5a25930381a1e3e471228d7bf3895bfc5784f0e6ca6b2ac680e2b545c11156f86ddfc13a80d79978c61d8d384
TLSH
T140F0F4B5D921AC3B1DFD1B7920940B47F790232B2A81985B3B3E811C8FB193B868596C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b9b88155a7de13880db09031e930a2335ae08299bc497299db87d85670063698
MD5 3a6e0851dd4172b7aa3761f458d111e2
SHA1 d69d5b8c7c3f2e0d612b47d2c3b52464df642648
SHA512 c70310f8be5cd82c8ae76f9217d17d18a6dabe2f9726300a2c3728b02383686c1b6f54642bd2dfdf0b1fada25aae9d1bf73f9539f83ddb256c456bf97e682739
SSDEEP 192:sxZWRBi5/fns8aQZLjZ8KzodpHQHW6+WNGYoW2SP+MIg5vtJYJ:sxZWq5/fns1OPexwHbGJSPfVtJ8
TLSH
T1D942E715AD28A97B9CC7D619FB157F53E3F91033A0851E48AAFC8A2C14EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 056332bd3c179bd6a8209fa5fbd998de9f244194a92b8e7dbb1185c6d0b714d8
MD5 99085977c5e8072337c65dfc5fb45a76
SHA1 d06f89e65c77e37bc2a97697564639720838cbc8
SHA512 286a4562c74ee5c19c2a5a9eacbbce8369097be9a3dd6294703d4611708be1d32ca0268f2ddcd8fee5b20d661851eee924f7cd9df4f7bf6a598bc73db8156864
SSDEEP 192:sxZWRBi5/fns+aQZLjO8KzodpH4HW6+WNGYoW2SP+MIgjtJYJ:sxZWq5/fnsXOPVxYHbGJSPfjtJ8
TLSH
T15F42D715AD28A97B9CC7D619FB157F53E3F91033A0851E48AAFC8A2C14EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6893ca3f938e105d8cdf5c33f733b46ab6bf59a02274a9e3fdce0f00fd349d2f
MD5 467834cc444cc6c670b8be0810ebf7da
SHA1 18274a91fa27403fea2276664d636172bd0388fd
SHA512 dc9d311d949805c6a535b07270c088ac5debea7cbb2c4057c180d0a3fd394c0cd15e536dff492d5dbcb4b144460d7982331393afd4b8435422bbd1402ee852dd
SSDEEP 192:sxZWRBi5/fnsoQZLjs8KzodpHhHW6+WNGYoo2SP+MIg5BftTJ:sxZWq5/fnsoOPjxBHbGHSPf/tF
TLSH
T1C142E855AD28A97B9CC7D219FB557F53E3F91033A0851E48AAFC8A2C14EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0d1227eff4c7cdd7bbcd9ed27fbeb80b067d2476a60d787978ae8bec71448d22
MD5 fc21cab099105e7d5a581230f72cbf74
SHA1 5eee1e7699929c00065d8ce52685bcac655f03f5
SHA512 77feb56f5ab6c26358014ed802f6938dc935b2a36792f4e459e67af74d37249501a5850157fc35d231e0939086001c1327cc5fc4166b24e39aeae0541bc1f9c3
SSDEEP 768:Px6r8sW7pLIL1G+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVe1qpLlvVajYrot:Px6r8s221G+WviyUKu1jab1qpLd4jjoo
TLSH
T181E2E97B780CCA7E4FC04ADDDD1A7F9B6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 c26e9323789f6d68b063283602a6a7f3271a291d8152424cdd829bba49ea8294
MD5 02bac9aa9ac77117cd842a625478f7a5
SHA1 da4159eddba03e4a712d2df95fc9b22409b3b33c
SHA512 7cc94dd58535fa746f4fde339ad4575ccfded28b414bd6649e2ef1f2494d5ebf1c4a5ea6304777e1b170651708f46f7122383271d1055cc30556d9bebdac1508
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVJDn2WrFKDYnjlF1+diTTb35RyTbqpj5bh:SL29ObJffppdNlJT2WZthh
TLSH
T15DC2125571BB021038FD390992B59B6E024232733119EA7B7FBD10A68E67F085DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 506cf5296f8add5769b6058fe99d50200e3e3fe1da4ea59c3e0ce602cae494fd
MD5 6f7492571745fef58ee17d2886a8ce90
SHA1 b061b1f07d320e28f59ee39b01b271d0fd448ea8
SHA512 0bfed13d0a20d211790522bf63eefa9a63c5e98a4932710717d714ba6bbb9a97ac7f4a24faecbcc7fbc36a2093280a6d50b9786c5acb274317b87ea576bc95f9
SSDEEP 384:niiFiZcI63sNS8TUNTUlIm2aKMiRi4w2fLBCJII/knr07O6R2Feo5gL/7IzyoB:pFQ63bwgcnoBCp/knr07TRx6
TLSH
T1FCC24B36EC98CABBEDFB8FDAA74A7607EEF40153948C5AC0D9D81D1D009759D0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 77ae64a04f8771fedfeec24ddd48f0c2eb1de40da8a2c1a0d6b58f2308166d4d
MD5 d775ce343f16acbf5d3f6a4c774c8892
SHA1 b7136a0b140833ba73718ea4aa41f846d61d64d9
SHA512 331d2412724d809d777922fd092b25dd63e6481d3be3d262735181f4ad211d2808d3fea1b5e04920d88056bc071f327eb722eb6c4968acc681d3c789204ff2cf
SSDEEP 384:nqiFiZcI63sNw8TUNTUlI4zaKMcMisw2fLBCJII/vuhnioJXRgL/7IzHoH:hFQ63ZwgVCsBCp/vaioJXZI
TLSH
T195C24A72EC98DEB7ECEB4AD5B74A3643DEE001A3988C9AC8D8D95D1C00971DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 21a26b31a7cd891778d6ab7847a6d4bc4181ef564a5eff9227fb34658735bd66
MD5 130474730ba71e4a86ba2ec14b334058
SHA1 539cb383f459a7efa45f543a1601188099c38277
SHA512 de3d8f80f1e45c26603456255f72deece3bec02e5654711c6a008efcfe0d1d3c7a0a88ae7b6051b7f0a4742d424cc13d1e907fbfe63de02d9f7ed39b71faee12
SSDEEP 384:npiFiZcI63sNw8TUNTUlI4zaKMc6iAw2fLBCJII/vuhnioJXRgL/7IzHoH:AFQ63ZwgHwgBCp/vaioJXZI
TLSH
T1DFC24A72EC98CEB7ECEB4AD9B74A3643DEE01163988C9AC4D8D95D1C00971DE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eabeac2c887a3378cbe2324b531a8f23e0437ac08c8e4c1879d4a5925613231d
MD5 0e342377ee9658adeb8f3753ec5752cc
SHA1 b8c60665d746aebf90c8a508d9c982743b018869
SHA512 e4fa7c6b2ac567a2331c9838b32fe8d8367c7fe87cd57d125b9203a6198fa5e7d2af6ae6d21c5420724ebab42717ef366fd34886f5c42b2c6ef834fc2f33165e
TLSH
T1FA412798B6EA110CB3B77E5AAFF6686D587BBD662E0AD05D10110E5F0A37B00CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0c2099eae51d2ffe6edbfc3f5b4407bd0f0925b12b47efa5a536bd6e3ff2c2ba
MD5 4978a7f60fc6a016d474b59170876c7a
SHA1 c7d4434517561dc47a8bf310fbf0c27a6831132b
SHA512 a32953bf07a2cf7fdc2f4d9a941af20827ee99006cbb111fe2e19500c8623fe75ca296da4209d061a74833d98ea1363fc97a4bc8f06282f7c91a33b5219a3b87
TLSH
T1B8218927F39C8961CC86163A509D9C1176B693C7819FDF9FBFC4D604A07F988CB21294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 51c829b869cb374769bd3d1c28c340d56fddd944cd3e9767c8557dc352681b0f
MD5 71b4202a80f608a30f082a4d41ebcec1
SHA1 27f6415ae1fe25f0c6ffbd39693e6c5c65eec97d
SHA512 e2fc12b601bf5470fad8a82af6524f7d0d2489bd5d9d4af7a0c72d7cc148c32990f17e874960016c682326d44cb6a7f6dd7d0857973727542030ecfe9866a4c8
TLSH
T105218927B3DC8961CC86163A509D9C2176B683C7819FDF9F7FC4D604A07F998CB21294
MD5 SHA1 SHA512 TLSH

Submit Download

1cfhey3p.dll

Path C:\Users\Admin\AppData\Local\Temp\1cfhey3p\1cfhey3p.dll
Size 5KB
SHA256 00db6f2df7ce9300777ebfabfbfc4ce6bce86bd043163d0894b7089fe7b385b7
MD5 0418b3ce6c46a37bb888549003c1481a
SHA1 82f18a171178d4b123e4b480656348c36ba01940
SHA512 2966c03eca1b78be49748c1f7a0cc8e7590216f44c887b2a5558536f60c98809c7ba9f901e84bb226a34e05de34e88df5fea1bc3870047bfe87dc3b9e52dcfc5
SSDEEP 96:BLn5ZMsOleAn0FtZNDUTLAEAr83zKvfj4SCpaVlh8uoYDK:BLnc3riUTLAEAr8DSfj4BpaVTit
TLSH
T1ACC1311393DC1552C2F35E7E6A620724D7B8F8346EBB975F4988737D6C81B50A8A2370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2FBBAA7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\2FBBAA7F.ps1
Size 3.1MB
SHA256 fddf11e00d94c8ba249770c513b333a45478c7cd3fd6c9952ae132704f20e3ee
MD5 e8059ddb2503e027e27e3befe8edfc2b
SHA1 c881c782ace382c642e7f0243835238afbb150fb
SHA512 8fbb561d62c2c08c69abd59bfb034a7a027320ea7733bf1b26fce26bc2d3af21618faa006c3c01e1cc07b808f5a85cacdf82159b19deb294ea1bdd04ea739343
SSDEEP 49152:dpKW6c/ns1AGhdw4KlGLwRbborBnjMsfu:h
TLSH
T1CDE51261766C9AE0C92E5D45A09C393740827EA643EBC3F1F7FFA8C52A86D9425DF4C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.ps1

Path C:\Users\Admin\AppData\Local\Temp\5688617F739C3CFF\script.ps1
Size 2.4MB
SHA256 4697f8288c2bf4607662cbfd44abb0e902bc0293b8b1829764f87a13e4fbbeb6
MD5 a45358a6483026f04d896805eb8ff311
SHA1 97462e68b0e0f96ea1f5efeba2b38f845aa38445
SHA512 0514fb1980e0278bf5a8c224ce97d6bed077a2e6d20fde7e4e7cdae4cf660102b66c970e56bfa5044eaa7a14e935a348c7e4ca2c1f2ae1ca313b69a4329ed407
SSDEEP 49152:nXvh7vnI1QvCNPt0v9+9wEoZJEFoLJ87sX/1k4dMqtxp:nZ8aKEY9wEDoL6qTdMET
TLSH
T11BB5CF909C1F833BDB9F8D0510FBFB176A26B7427AD7374AC8B09051CE59A10AE56C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5D2F2A7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\5D2F2A7F.ps1
Size 3.1MB
SHA256 e1f18f06dd5878e94536f12e3cd5ec100e8eaf7e00b7647020a3d8a9be4e4e73
MD5 ef7a996dc6625bab3e033c61905936e5
SHA1 c15232ef1d47365425b94aa7c2e1a06ee0732dee
SHA512 71c1940263b44f32058059bf48b40ed76ac8b0872bc9b1d0a2ce7febe25a62396b88382136a78eeb03506309cdd92a76369983c643c57457ee3f545e753000c6
SSDEEP 49152:dpKW6c/ns1AGhdw4KlGLwRbborBnjMsfm:x
TLSH
T1D6E51261766C9AE0C92E5D45A09C393740827EA643EBC3F1F7FFA8C52A86D9425DF4C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61E4AA7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\61E4AA7F.ps1
Size 3.1MB
SHA256 64d2738dfc05e01deafcc0e818f84a387a8e531b80101b358babb49f60963486
MD5 724ad8da37e0686f049e4323b916eecb
SHA1 39667c77867fb3ce206fd915b1cc78cfe6e0cee7
SHA512 0456444856bdd3791367d8510ea02b4847babb2a508daefe96da951f830267eebbe4d79b920d7cf9aea9ef9410ad9deaf26eb1fd070dc4aff2513b4f3b0c5f1d
SSDEEP 49152:dpKW6c/ns1AGhdw4KlGLwRbborBnjMsfW:5
TLSH
T1D3E51261766C9AE0C92E5D45A09C393740827EA643EBC3F1F7FFA8C52A82D9425DF5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2B.tmp
Size 1KB
SHA256 d367a24a78b3f2f237951cb186dc322c48ccbfab03b7112acd4206ca1a69d75c
MD5 2e70a455091ace457cad2dac528c70a7
SHA1 1e1546cf5b595898694e282e7e0be056cb51b834
SHA512 57d581c080eb0742f5ef333407041f4b7f8fe455191b1c1b74882cc98989ad2761aea7a891c83d7aed106f99ad248f64e9028a863771335bef9b00b965011f39
TLSH
T14321CC0993ED431BF0739731A9FA532BA534FD61EFB1635E858042292C51600EEB1E73
MD5 SHA1 SHA512 TLSH

Submit Download

RESF696.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF696.tmp
Size 1KB
SHA256 4eb72af648b1dcc2b99f9409ad5b35db445cb8fd5f9cc51afaa10aea38c3bbef
MD5 0ae46200001b8007cac4753e2bde6f1e
SHA1 be87a827c471a6d1094eee9d11efb1f7e6a823dc
SHA512 069e68bb98f45f569c1586163e66f983a25baafab75c68b3068414c933e5d75a72f778c5d88d1b793e3f46e81285b946d6b54df12002c9df5f06ad66dc389de7
TLSH
T16221CC0553ED470AF0B3573169FA136FA638FD99EF71935B854042281C40A14EEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bnjova5e.f3k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bnjova5e.f3k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ed12dm5m.dll

Path C:\Users\Admin\AppData\Local\Temp\ed12dm5m\ed12dm5m.dll
Size 5KB
SHA256 62ea2bfe3d50aeebf39c26246dc1a19d62c65122991625a4ffdd1099417e4ce6
MD5 fe0cfa7904d2daf90061c9da11bcb471
SHA1 44bf4ce70a9e8ef94ec3feae85ef94a37c29f763
SHA512 89604564721d414a5e07df8d82b111ad48e3c3f3540685be9b716398cc42c02efb19aca27c65c929da4f1eafab4d0311a808f503e949cfb71d6bfc37554ad59b
SSDEEP 96:mLn5ZMsOleAn0FtZNDUTLAEAr83zKvMIj4SCpallk8uoYzK:mLnc3riUTLAEAr8DSvj4BpalOi9
TLSH
T1F5C1531393DC0552C2F35EBD69620725D778F8346EBB935F4589737E6C81790A8A2370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificacion_53974.html

Path C:\Users\Admin\AppData\Local\Temp\notificacion_53974.html
Size 27KB
SHA256 2fd0490ee3fba0fdad9515ac9a4533e4725bf8922c23a7bb5ec95ee05ecffd4c
MD5 48d57e0e23a1e0e80db8497ffa5a219c
SHA1 6f79880cc83bba1c9dbd02d6f301cc74576a7af0
SHA512 3b42dfd03086f2d054d4f76ebbd0e3b6b37da629287be21881af13fd9f36e97fa5e54830c0b1a7df44ea252aaedcfcb4f0caa49745dbfc7db762c76078d72f9f
SSDEEP 384:LvkoF+I1JQXEorEemSUO0WyVGQnrZodmWpFlvXi3OeAJap/0Gw/h9dHTWnJNlE3y:LbFNboQLQWqASvy31AM/0GwRHTWnblX
TLSH
T1EDC2BE7681C8001164AB91F5B062BFDBF095D73BD4B7E6749CBEEA6A8EC3990C611708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plyafsf0.dll

Path C:\Users\Admin\AppData\Local\Temp\plyafsf0\plyafsf0.dll
Size 5KB
SHA256 10c72761a98edc697cdd104624ac59b8b2b9fdd1e022e4d0103b4528595d2465
MD5 ffd4ff114853bbd1a7689294ae0103ff
SHA1 fd41248c5611dae828299b0754d665dbe353da6f
SHA512 6ddc2550351faaddcee19a85a1c5176259d68a69d349c6042370f7d963cae90cbecde94967c6b90f1be61645d45e2babdbb9a5a2119f6d9ab0b5d67d7931be9b
SSDEEP 96:iLn5ZMsOleAn0FtZNDUTLAEAr83zKv3j4SCpaVlhs8uoYPK:iLnc3riUTLAEAr8DS3j4BpaVDsix
TLSH
T1C4C14F1393DC0556C2F35E7E69620721D7B8F8346EBB935F4888B37E6C81780A8A2370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~WRFRv0PGZu5lw.tmp

Path C:\Users\Admin\AppData\Local\Temp\~WRFRv0PGZu5lw.tmp
Size 3.2MB
SHA256 02e0947f99b0202775dd977ee6e305cff30ac43986f459c6719db132ed0ec164
MD5 f73c4c67280ff1db09b46bccfb46cafb
SHA1 b414fb40f2c45bd7aebe4b151b2c3f304983a52b
SHA512 5b1e2f051836364aa82f8934ee4a4e8c0c73640055cfb983b12e94bd6385a3fb1eb3ded66900c3a630e8560418d78e13ceb9601e289b6c3ba93b65f8be392524
SSDEEP 49152:X41oxkstYGSZwnrlftuqociscYrK2q0Kx:u
TLSH
T12CF51220766C57B0C92E5D09905D397B9082BE7283E783F1F7BEECC12A92D9425AF4D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~WRFRv0PGZu5lw.tmp

Path C:\Users\Admin\AppData\Local\Temp\~WRFRv0PGZu5lw.tmp
Size 41B
SHA256 c88043435afbb11054625d45f9f3304df8ccc3693bde32b69284692cbc9f6281
MD5 76c178aa9b15b68ad48269b7186b54c3
SHA1 ab1842b32c19f274be1234a982ba0012db5ba3f1
SHA512 c1e283896e72812c838366b111fd02ee42b2f5d02795ab7cfb24f6f9e5503404ed3489ff2ff46b32184bcc2a0ada34fbcc3c957e965cd249944b813b1753fbf7
MD5 SHA1 SHA512

Submit Download

~WRFRv0PGZu5lw.tmp

Path C:\Users\Admin\AppData\Local\Temp\~WRFRv0PGZu5lw.tmp
Size 39B
SHA256 e66cce2d7733ca8cb244b2f8eff6700a0359cf6605e1fab9c8b22fe379961e05
MD5 cd70a8cf09efa4e9f0762a3bd167339e
SHA1 885f9acb65729a9a5fa0ff5e52c4b0c54401c193
SHA512 a9a8aa213686c3acef21fd806e0ad77063cbaeb29646b4e1277ef61641267f9acbb985b7e1718819d3e8a5151eade1873689799f2c7c20a8dc20c611d85ad4ef
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

SvcShieldZdsL36.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SvcShieldZdsL36.vbs
Size 3KB
SHA256 1eaff6a6c88e058d3a3b763a2b3d2146a2e1fa54af3c28ce0d5426e257e444e4
MD5 ade335e6aef31051aea0a7711a39c60e
SHA1 22a1bcf546495453529a9e4c18604cf8f1f793ec
SHA512 ddf717522acd8163c54dee89e1e5e6253b766bb616c9a22965b2b8158cf3ece71f16c5776c90c46d59d41f04bd497d08e397ba3c7da2495504db86fc0ed10888
TLSH
T16D711FAE1B0E106DF19B5A90684F28B839F9C0537BF192487B3783873D3358991612ED
MD5 SHA1 SHA512 TLSH

Submit Download

index_ZdsL36.xhtml

Path C:\Users\Public\index_ZdsL36.xhtml
Size 3.2MB
SHA256 68eda7200b4050f41767e419343c7b7c09ceed72a53db7949c8df56eb77c77e2
MD5 f07b485e0aaa8d0a1baaa8c3ea533a12
SHA1 952b973d569588aae589c321c14511ad5372290c
SHA512 959e81549d5dbb456bd635f5f88c3cbe8c2b23aa7539517cba9d317c195cea3af10a14246b1b70aafd3e6aa11b966840542d08613c4ecf69d00e93391b5550f9
SSDEEP 49152:8VB1exgHd/mro2SWLrnboDtinOolbQZXd86v2ziBI3n5PQtC:J
TLSH
T198F5128D6A638E655C7C991872BCAC5C1633E9F40E9DE3C3E6FED284B4667CA4301493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cfhey3p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1cfhey3p\1cfhey3p.cmdline
Size 369B
SHA256 401ee48d35ab5541e6d549735b1fe51391fb2f63da61a58784bc53323586cd83
MD5 c48c2741aeb7e0623ee09b719f088bb4
SHA1 02847939eea6a3c75bd56607b6cae4937fe53a50
SHA512 c4b3c6a1783aa618aa2ec83482259327af509ee80defd5b6ef8f429331464817f08e25be67ea5398090890da5feca4e451f7b14bd45c9549aa43a79f4403d998
TLSH
T13FE0683B8297C6BD01DD210F22A9C4FCCA7306CF29603F84725DE40DD01780127D2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7D6F67AEA8A349008E5AB967A8296579.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1cfhey3p\CSC7D6F67AEA8A349008E5AB967A8296579.TMP
Size 652B
SHA256 075c39763a653036c23ea2851439e5a8ffb04614d5bfbb9f57ff6c5f02e34e0f
MD5 d8b0758a63c1d1e6ff7968b1bd39425f
SHA1 38eb562f68a102614380f9bd024cc0e0d05bf242
SHA512 935dd53e33199bcf655c118bb05704721e6e1d2c506d8656443db03d141cea03557e9f930be294375a8b1186c732bdf9a1c2f0bee653648365a596f2e2ba48fa
TLSH
T1FDF05E0963F8020EF0F34B30BEF68363A5A8BC69DE3293ED1440431928649148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFD52110BE9E64C68BEEA2C2430FCE7A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ed12dm5m\CSCFD52110BE9E64C68BEEA2C2430FCE7A.TMP
Size 652B
SHA256 73cb296ac0a101f51b0e9c89bd6f4d989b77439fbb3afbfd6658c4144db658e0
MD5 50a93f58df5b9ebef5585b5ee16bc9f1
SHA1 eff964ddc721b400ac13132e803e2c53441e5c0b
SHA512 57e957c7e4d4ec9fc1d91a7ffea4e56ed37ab9420120c8987afa8e95f8c6041fc05feaf0b5dcfb7378ad1990b1966c8bf54ac9af7b3822502388cbd7e2b9837d
TLSH
T14BF0300A63FC020AF0F34B70B9F64367A569BC64DE3253ED1480035D1C646109A61F75
MD5 SHA1 SHA512 TLSH

Submit Download

ed12dm5m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ed12dm5m\ed12dm5m.cmdline
Size 369B
SHA256 71a571ec6e66e6fae784b48f5fd5b135473ada52d95104f8bfb7218d40c134ab
MD5 a15da60022a0d9ce6ac32eeb8db781ce
SHA1 717b3c6c6451303826a2e85004fd94bf26ed7383
SHA512 4d67b48259c3a8a60fe8a2e8a7fb0c8fd698144cd2df223fff45a967b2be0cbf49df32db99d4854b9931106d6884d37084606ab7c66a7c62b9e8c2d3c85b6fc7
TLSH
T190E0C63A6246C27D29FF708B326AECACCA72079B29C13F849040C40DF067000ABD2BA1
MD5 SHA1 SHA512 TLSH

Submit Download

plyafsf0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\plyafsf0\plyafsf0.0.cs
Size 2KB
SHA256 503536886aa5f78fbd62bf58ac176a47ca5ece613ec1288c16664309d91ba711
MD5 756c508f570517c72680b7607b3edfdd
SHA1 22d36248e71e7eef46fe86a35e3bd8c44b4b0f42
SHA512 d36ead53b07c9c74aee048a39e10db6ec6d382137adca1ee3b39361f797c72d3888b5de64a110b0b992d314d3d084511621449c92a2d5bd604d48d7115354bdd
TLSH
T1974199284395D23A45A7296ED9DBD72FEA13763136FC3A0005BBDF201E46185E07772E
MD5 SHA1 SHA512 TLSH

Submit Download

plyafsf0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\plyafsf0\plyafsf0.cmdline
Size 369B
SHA256 81288c3dd87cddd9ac50a1035a13add4bd80f7fcf51aaa052ed809caa9c02fc9
MD5 c8ccba1092f0259473f7d14acc8cba0f
SHA1 50bd1ca58ded541c41eca0e923648b2d2f950216
SHA512 072f580a52dbef57862bdaaa77ca5e1c57a23e62d3706e624c490acacb55e93a15ba6bb35b029228ed01082957cfb1e796eb968c9799c2a3240534d14cf2a6b2
TLSH
T1D7E0682A639AC2BE11E9100B216FE4ECE27207EB29407F98589044CDE0170022BD3741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1388-819-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/1388-806-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/1388-814-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/1388-820-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/2468-928-0x000001951D720000-0x000001951D728000-memory.dmp

Download

memory/3356-641-0x000002D06B640000-0x000002D06B650000-memory.dmp

Download

memory/3356-642-0x000002D06BB50000-0x000002D06BC52000-memory.dmp

Download

memory/3356-631-0x000002D06B650000-0x000002D06B672000-memory.dmp

Download

memory/3356-630-0x000002D06B8B0000-0x000002D06B932000-memory.dmp

Download

memory/3356-775-0x000002D06B680000-0x000002D06B688000-memory.dmp

Download

memory/4044-847-0x00000201D26E0000-0x00000201D26E8000-memory.dmp

Download

memory/4964-849-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/5656-932-0x0000000140000000-0x00000001401F0000-memory.dmp

Download