IOC Report
https://documentsonline2708.b-cdn.net/F6JUEVES29/PRESUPUESTOREVISADO_0003247.REV

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 15:57:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 15:57:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 15:57:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 15:57:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 29 15:57:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\Downloads\996f2d03-2980-43c6-bedd-182b2c49685a.tmp
7-zip archive data, version 0.4
dropped
C:\Users\user\Downloads\PRESUPUESTOREVISADO_0003247.REV (copy)
7-zip archive data, version 0.4
dropped
C:\Users\user\Downloads\PRESUPUESTOREVISADO_0003247.REV.crdownload
7-zip archive data, version 0.4
dropped
Chrome Cache Entry: 97
7-zip archive data, version 0.4
downloaded

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://documentsonline2708.b-cdn.net/F6JUEVES29/PRESUPUESTOREVISADO_0003247.REV
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2008,i,2757202989012273427,4713699337427981818,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Windows\System32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding

URLs

Name
IP
Malicious
https://documentsonline2708.b-cdn.net/F6JUEVES29/PRESUPUESTOREVISADO_0003247.REV
https://documentsonline2708.b-cdn.net/F6JUEVES29/PRESUPUESTOREVISADO_0003247.REV
169.150.236.104

Domains

Name
IP
Malicious
documentsonline2708.b-cdn.net
169.150.236.104
www.google.com
142.250.186.68

IPs

IP
Domain
Country
Malicious
142.250.186.68
www.google.com
United States
169.150.236.104
documentsonline2708.b-cdn.net
United States
239.255.255.250
unknown
Reserved
192.168.2.16
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Mozilla Firefox\firefox.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Mozilla Firefox\firefox.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Internet Explorer\iexplore.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Internet Explorer\iexplore.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\mspaint.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\mspaint.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\root\Office16\Winword.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\root\Office16\Winword.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Windows Media Player\wmplayer.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Windows Media Player\wmplayer.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.ApplicationCompany
There are 8 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
22BF0ACC000
heap
page read and write
22BF0AE1000
heap
page read and write
22BF2AAE000
heap
page read and write
22BF2AB2000
heap
page read and write
22BF2BCD000
heap
page read and write
22BF0ABB000
heap
page read and write
22BF2AC0000
heap
page read and write
22BF2C00000
heap
page read and write
22BF0A10000
heap
page read and write
22BF2C06000
heap
page read and write
22BF2AA6000
heap
page read and write
22BF2C53000
heap
page read and write
22BF2AB5000
heap
page read and write
22BF2BDB000
heap
page read and write
22BF2C52000
heap
page read and write
22BF2ACE000
heap
page read and write
22BF2A93000
heap
page read and write
22BF2C58000
heap
page read and write
22BF0B19000
heap
page read and write
22BF53DF000
heap
page read and write
22BF0AF1000
heap
page read and write
22BF2B60000
heap
page read and write
22BF2A86000
heap
page read and write
22BF2ABD000
heap
page read and write
22BF2BF2000
heap
page read and write
22BF53BC000
heap
page read and write
22BF2A8F000
heap
page read and write
22BF0ACB000
heap
page read and write
22BF0B1D000
heap
page read and write
22BF2C2F000
heap
page read and write
22BF2C15000
heap
page read and write
22BF2A9E000
heap
page read and write
22BF2C5B000
heap
page read and write
22BF2ABD000
heap
page read and write
22BF2A95000
heap
page read and write
A832AFC000
stack
page read and write
A8325A6000
stack
page read and write
22BF2B71000
heap
page read and write
22BF2C07000
heap
page read and write
22BF0AC1000
heap
page read and write
22BF2BF2000
heap
page read and write
22BF2A70000
heap
page read and write
22BF0AC3000
heap
page read and write
22BF2C27000
heap
page read and write
22BF2AB2000
heap
page read and write
22BF2A93000
heap
page read and write
22BF53F0000
heap
page read and write
22BF2AAE000
heap
page read and write
22BF2AB2000
heap
page read and write
22BF2ABB000
heap
page read and write
22BF2A8F000
heap
page read and write
22BF2C02000
heap
page read and write
22BF0A20000
heap
page read and write
22BF2AB7000
heap
page read and write
22BF5408000
heap
page read and write
22BF2A9A000
heap
page read and write
22BF0AE5000
heap
page read and write
22BF2AC1000
heap
page read and write
22BF2C5D000
heap
page read and write
22BF2BFA000
heap
page read and write
22BF2B6D000
heap
page read and write
22BF2AB2000
heap
page read and write
7DF4EA8A1000
trusted library allocation
page execute read
22BF2A87000
heap
page read and write
22BF2B93000
heap
page read and write
22BF5405000
heap
page read and write
22BF2AA2000
heap
page read and write
22BF2BF6000
heap
page read and write
22BF2A89000
heap
page read and write
22BF2B83000
heap
page read and write
22BF2A75000
heap
page read and write
22BF2C00000
heap
page read and write
22BF2AC2000
heap
page read and write
22BF2A77000
heap
page read and write
22BF2AB8000
heap
page read and write
22BF0B14000
heap
page read and write
22BF2AB2000
heap
page read and write
22BF2C31000
heap
page read and write
22BF2BA7000
heap
page read and write
A8329FF000
stack
page read and write
22BF2C11000
heap
page read and write
22BF2C45000
heap
page read and write
22BF2C29000
heap
page read and write
22BF2A70000
heap
page read and write
22BF2BA9000
heap
page read and write
22BF2BF6000
heap
page read and write
22BF0ADF000
heap
page read and write
22BF53E4000
heap
page read and write
22BF0AC7000
heap
page read and write
22BF53DF000
heap
page read and write
22BF2ABF000
heap
page read and write
22BF2BCD000
heap
page read and write
22BF2A70000
heap
page read and write
22BF2BF6000
heap
page read and write
22BF23D4000
heap
page read and write
22BF2C47000
heap
page read and write
22BF0A9D000
heap
page read and write
22BF2BFB000
heap
page read and write
22BF2ABD000
heap
page read and write
22BF0ADC000
heap
page read and write
22BF0AC0000
heap
page read and write
22BF2AB8000
heap
page read and write
22BF53B0000
heap
page read and write
22BF2B99000
heap
page read and write
22BF2C5E000
heap
page read and write
22BF2B8F000
heap
page read and write
22BF2AC8000
heap
page read and write
22BF2AAE000
heap
page read and write
22BF56D0000
trusted library allocation
page read and write
22BF0AF5000
heap
page read and write
22BF2C27000
heap
page read and write
22BF2AC5000
heap
page read and write
22BF2A8F000
heap
page read and write
22BF2ABC000
heap
page read and write
22BF53E0000
heap
page read and write
22BF2AB6000
heap
page read and write
22BF2AAA000
heap
page read and write
22BF2BA7000
heap
page read and write
22BF0AC5000
heap
page read and write
22BF2A8F000
heap
page read and write
22BF2C0D000
heap
page read and write
22BF2B99000
heap
page read and write
22BF2BD3000
heap
page read and write
22BF2A9E000
heap
page read and write
22BF2ABF000
heap
page read and write
22BF2AA6000
heap
page read and write
22BF2C09000
heap
page read and write
22BF2BEC000
heap
page read and write
22BF0A77000
heap
page read and write
22BF2A83000
heap
page read and write
22BF53D0000
heap
page read and write
22BF2B7A000
heap
page read and write
22BF2B8F000
heap
page read and write
22BF2A98000
heap
page read and write
22BF2AC2000
heap
page read and write
22BF2AAE000
heap
page read and write
22BF2B95000
heap
page read and write
22BF2AC0000
heap
page read and write
22BF2BC9000
heap
page read and write
22BF7A00000
heap
page readonly
22BF2C2B000
heap
page read and write
22BF2B8F000
heap
page read and write
22BF2C40000
heap
page read and write
22BF2C31000
heap
page read and write
22BF2A98000
heap
page read and write
22BF2C57000
heap
page read and write
22BF2AAA000
heap
page read and write
22BF2AC0000
heap
page read and write
22BF0ADE000
heap
page read and write
22BF2A71000
heap
page read and write
22BF2A9E000
heap
page read and write
22BF2A8F000
heap
page read and write
22BF0ABA000
heap
page read and write
22BF23D0000
heap
page read and write
22BF0ABB000
heap
page read and write
22BF0AE4000
heap
page read and write
22BF5800000
heap
page read and write
22BF2C50000
heap
page read and write
22BF2AAA000
heap
page read and write
22BF2AAE000
heap
page read and write
22BF2A83000
heap
page read and write
22BF0AD1000
heap
page read and write
22BF0ACB000
heap
page read and write
22BF2BA9000
heap
page read and write
22BF0AE9000
heap
page read and write
22BF2C09000
heap
page read and write
22BF2BC3000
heap
page read and write
22BF2BC1000
heap
page read and write
22BF2C58000
heap
page read and write
22BF2A89000
heap
page read and write
22BF2B87000
heap
page read and write
22BF2BFA000
heap
page read and write
22BF2C2D000
heap
page read and write
22BF2BFD000
heap
page read and write
22BF0AEE000
heap
page read and write
22BF4CB0000
trusted library allocation
page read and write
22BF2ACB000
heap
page read and write
22BF2C3D000
heap
page read and write
22BF2AA2000
heap
page read and write
22BF0ACD000
heap
page read and write
22BF0AD2000
heap
page read and write
22BF0ABF000
heap
page read and write
22BF2AB9000
heap
page read and write
22BF0AD8000
heap
page read and write
22BF2BE5000
heap
page read and write
22BF2A93000
heap
page read and write
22BF2C34000
heap
page read and write
22BF2C4B000
heap
page read and write
22BF2A9E000
heap
page read and write
22BF2A8A000
heap
page read and write
22BF2BDC000
heap
page read and write
22BF2A93000
heap
page read and write
22BF2A98000
heap
page read and write
22BF0BF0000
heap
page read and write
22BF7122000
trusted library allocation
page read and write
22BF2AAE000
heap
page read and write
22BF2B97000
heap
page read and write
22BF2AA6000
heap
page read and write
22BF2C02000
heap
page read and write
22BF53B4000
heap
page read and write
22BF2C27000
heap
page read and write
22BF2BC8000
heap
page read and write
22BF2A8F000
heap
page read and write
A832B7B000
stack
page read and write
22BF540D000
heap
page read and write
22BF2C11000
heap
page read and write
22BF0B12000
heap
page read and write
22BF0AE7000
heap
page read and write
22BF2B91000
heap
page read and write
22BF0AE3000
heap
page read and write
22BF5405000
heap
page read and write
A8328FE000
stack
page read and write
22BF23E0000
heap
page read and write
22BF2A60000
heap
page read and write
22BF2B8F000
heap
page read and write
A832A7D000
stack
page read and write
22BF2ABD000
heap
page read and write
22BF0AE1000
heap
page read and write
22BF0AA0000
heap
page read and write
22BF53BD000
heap
page read and write
22BF2C0C000
heap
page read and write
A83287E000
stack
page read and write
22BF2BD9000
heap
page read and write
22BF2C3B000
heap
page read and write
22BF0AA1000
heap
page read and write
22BF2A96000
heap
page read and write
22BF2B9B000
heap
page read and write
22BF2A87000
heap
page read and write
22BF2B6F000
heap
page read and write
22BF2AAA000
heap
page read and write
A83297E000
stack
page read and write
22BF2ABE000
heap
page read and write
22BF2AAF000
heap
page read and write
22BF2AC5000
heap
page read and write
22BF2BC1000
heap
page read and write
22BF0AEB000
heap
page read and write
22BF540E000
heap
page read and write
22BF2A79000
heap
page read and write
22BF2AB8000
heap
page read and write
A832D7B000
stack
page read and write
22BF2B6D000
heap
page read and write
22BF2C4A000
heap
page read and write
22BF2C2D000
heap
page read and write
22BF2AA2000
heap
page read and write
22BF2A9E000
heap
page read and write
22BF2ABD000
heap
page read and write
22BF2AC6000
heap
page read and write
22BF2BE0000
heap
page read and write
22BF2C06000
heap
page read and write
22BF2A9E000
heap
page read and write
22BF0AFA000
heap
page read and write
22BF25E0000
heap
page read and write
22BF2BCD000
heap
page read and write
22BF0AB1000
heap
page read and write
22BF2A88000
heap
page read and write
A832E7F000
stack
page read and write
22BF2A8F000
heap
page read and write
22BF2AC5000
heap
page read and write
22BF0A92000
heap
page read and write
22BF2BE9000
heap
page read and write
22BF2BC3000
heap
page read and write
22BF2A7B000
heap
page read and write
There are 252 hidden memdumps, click here to show them.