bandook | 188357aad90355aa2b2fbd6080eeca00b35f63dcd8d4584740daf019f6be3298

Resubmissions

26-07-2023 20:29

230726-y9p2sagd4x 10

Analysis

max time kernel
1199s
max time network
1193s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

página-principal.html
Size

45KB
MD5

0ee4dfff7498f365912b544f2991928f
SHA1

a92be3cd8fcfff5eb7707c50d8c86abb3a6951e0
SHA256

188357aad90355aa2b2fbd6080eeca00b35f63dcd8d4584740daf019f6be3298
SHA512

34e051b67ba256aceeebb7ccea0dc20885ae1990ae910996f6ceaacfbcf04861d79b961ec15377ce4b03bc01e2e4e2df73ed0631dec22f725bb65f28cf03daae
SSDEEP

384:YzexVkJRwmxjXzzexVALPHKi32qp8+5qz+lhkD+DHq+ViL52i4hbV1G+nm+qHQx:qeARwez3e8RjqAkoHR9y+nyS

Score

10^/10

bandook discovery persistence rat trojan upx

Malware Config

Extracted

Family

bandook

185.10.68.52

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2860-1035-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2860-1037-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2860-1038-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2860-1039-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2860-1041-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2860-1043-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/2860-1048-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook
behavioral1/memory/3648-1124-0x0000000013140000-0x00000000140F0000-memory.dmp	family_bandook

Executes dropped EXE 4 IoCs

Processes:

7z2301-x64.exe7zG.exeNuevo_Documento2607.pdf.exeNuevo_Documento2607.pdf.exe

pid	Process
1884	7z2301-x64.exe
4000	7zG.exe
1820	Nuevo_Documento2607.pdf.exe
3444	Nuevo_Documento2607.pdf.exe

Loads dropped DLL 3 IoCs

Processes:

7zG.exe

pid	Process
3156
3156
4000	7zG.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

7z2301-x64.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2860-1032-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1034-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1035-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1036-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1037-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1038-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1039-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1041-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1043-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/2860-1048-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/3648-1121-0x0000000013140000-0x00000000140F0000-memory.dmp	upx
behavioral1/memory/3648-1124-0x0000000013140000-0x00000000140F0000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msinfo32.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Windows\CurrentVersion\Run	msinfo32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QQE = "C:\\Users\\Admin\\AppData\\Roaming\\QQE\\QQE.exe"	msinfo32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 64 IoCs

Processes:

7z2301-x64.exe

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2301-x64.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt	7z2301-x64.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2301-x64.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2301-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133348770068466045"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

chrome.exeOpenWith.exe7z2301-x64.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "6"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f44471a0359723fa74489c55595fe6b30ee0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 6800310000000000fa560ca410003236303732337e312e50444600004c0009000400efbefa560ca4fa560ca42e00000033f401000000040000000000000000000000000000006dd46f0032003600300037003200330064006f0063002e0070006400660000001c000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "8"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exemsinfo32.exe

pid	Process
4396	chrome.exe
4396	chrome.exe
4260	chrome.exe
4260	chrome.exe
2860	msinfo32.exe
2860	msinfo32.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

OpenWith.exeOpenWith.exechrome.exe

pid	Process
832	OpenWith.exe
1420	OpenWith.exe
3012	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

chrome.exe

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe
Token: SeShutdownPrivilege	4396	chrome.exe
Token: SeCreatePagefilePrivilege	4396	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exe

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4000	7zG.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	Process
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe
4396	chrome.exe

Suspicious use of SetWindowsHookEx 62 IoCs

Processes:

OpenWith.exe7z2301-x64.exeOpenWith.exechrome.exe

pid	Process
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
832	OpenWith.exe
1884	7z2301-x64.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
1420	OpenWith.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 4396 wrote to memory of 972	4396	chrome.exe	88
PID 4396 wrote to memory of 972	4396	chrome.exe	88
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 1716	4396	chrome.exe	91
PID 4396 wrote to memory of 3016	4396	chrome.exe	92
PID 4396 wrote to memory of 3016	4396	chrome.exe	92
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93
PID 4396 wrote to memory of 4576	4396	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\página-principal.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf25c9758,0x7ffaf25c9768,0x7ffaf25c9778
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5028 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5096 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1708 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5712 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5832 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6088 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4448 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4940 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5832 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6236 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6204 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6360 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6240 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6400 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:4112
- C:\Users\Admin\Downloads\7z2301-x64.exe
  "C:\Users\Admin\Downloads\7z2301-x64.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5844 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5244 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6088 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=748 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=4996 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=6312 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 --field-trial-handle=1824,i,9061273706375888037,403519053904469029,131072 /prefetch:8
  2⤵
  PID:1408

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\260723doc.pdf\" -ad -an -ai#7zMap24604:86:7zEvent17243
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4000

C:\Users\Admin\Downloads\260723doc.pdf\260723doc.pdf\Nuevo_Documento2607.pdf.exe
"C:\Users\Admin\Downloads\260723doc.pdf\260723doc.pdf\Nuevo_Documento2607.pdf.exe"
1⤵
- Executes dropped EXE
PID:1820
- C:\windows\SysWOW64\msinfo32.exe
  C:\windows\syswow64\msinfo32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Users\Admin\Downloads\260723doc.pdf\260723doc.pdf\Nuevo_Documento2607.pdf.exe
  C:\Users\Admin\Downloads\260723doc.pdf\260723doc.pdf\Nuevo_Documento2607.pdf.exe ooooooooooooooo
  2⤵
  - Executes dropped EXE
  PID:3444
- - C:\windows\SysWOW64\msinfo32.exe
    C:\windows\syswow64\msinfo32.exe
    3⤵
    - Adds Run key to start application
    PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
4e35a902ca8ed1c3d4551b1a470c4655

SHA1
ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c

SHA256
77222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9

SHA512
c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
4e35a902ca8ed1c3d4551b1a470c4655

SHA1
ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c

SHA256
77222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9

SHA512
c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
684KB

MD5
50f289df0c19484e970849aac4e6f977

SHA1
3dc77c8830836ab844975eb002149b66da2e10be

SHA256
b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305

SHA512
877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
39KB

MD5
500ecdda9ad3e919a1f41c1588266a1b

SHA1
d5ddf92dc08284a48701a4d3555590bda05f77e0

SHA256
caad3feace9086d27e006d538d2daf4dd50e2b33307232a7db6d5f8c48f73b37

SHA512
5e47a0d0721ec0f9adb5a439ffc98c1b4da780e74270332313f8350f228bdb919d32c4812c6ede84ebae3ead1342c2eaf4c73f4dfca5a87e8887e1b5913c0d9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038

Filesize
171KB

MD5
442d0e9e8515f3517372c89d7d94fe9b

SHA1
768598cde1ba553c3b208f842b06eb80b94f2939

SHA256
205f37c78cda70f635fd72e1d99079d7c4d88e54e88b04a0d746455eefe3b979

SHA512
cd396095eb7640706063c45d951e49ec380ddd5f61088a26df2471d4424b14579708842ff971a5abe41f03218364ee5f7246d26bf2a0d3e08998bd580abcf739

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
888B

MD5
1c12fb58fc4974d88bfa018b7f85241d

SHA1
c2bdd7063be5efd21d66494767e0e8af8fee1206

SHA256
bcd33b642f69a39f218ffe748bd43cf092b13b43a3acb679f1dc3d275ddfbc32

SHA512
c0c4c2da676d968a69711b0e3cd010ae5482274123faf25e6eb71992bdd28e74563fe98ee08cdb6abfaa05a47af5eabfa1f1cdfcbb70eefb2266f6f5857471b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
9ccdb12b864416416b34a957c42a6b48

SHA1
a19d1ea34dc66fe31b756e7154a5d079e467bb0c

SHA256
cc7a6f3af8d2e3d80bd8f7782fea8b3fac8c33aa09f61320c4e50cddaa486c8e

SHA512
aa34c31e53cc4cae7ddeb8d681a8a0327ab8965dd4af96bcea7bbdc2e24a152547cd6a04aa90600e1494541c8158c5cfecab51dfa3816a408b6e8f50effb145d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
25627741ce67cb1ed1e8c030cf832837

SHA1
f112e2790bfe1c29d49e4db149a4dbdb6c4a95bf

SHA256
7f7e219cac8c4b5447f3453c3987e94f4fbabf7ba02266d6b91e2da786de4041

SHA512
44b62d2b7c131daa0ba5e0429cde90713e5a5c9426297927cd59a3aafc536384cc0e86d5dca271f504674c746a0ef1081360abe84c818194dd7048ddf7e8bcb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
083f33ad474668628ea8d8a29a5c6737

SHA1
87f2c950f643f694e2b0e4a0f5756b3c5293eb14

SHA256
68d043be0ffd2105d565428821c9846235ea02830e7e583fe7a0b8369aabe276

SHA512
e77735d5bc4c32528338ae86dad5868d2f4e47db3ce996da5d81a9c1a39b6d9f5e536e20d2aacfdea510b7cd58c96123922f0837e93bc7c3fed48849a7de6835

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
66dd683452520e83bdffe5eadcbb8b8c

SHA1
b41976dbf8ac8fca4b9154a6080bdd84dfa72c2b

SHA256
4f7fe7328937c04a4c822ee066e9de1dd2ba907d717d03659359672238d116c9

SHA512
6547bb16729cc1c8d83a041195fa055172adda93ad62a72359c1f9c47295141659bae354b008f61a7b7dcbbdb851fd2f85e8c901b5a34bff6842d18a2d6aaa6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
06a7bea9b927a95d923bffa7c9158a4c

SHA1
597ca1a018a16a1be6a032da4090f0efa5726226

SHA256
92be504f2d8e43bfdaea5ff98c1023f480d62796c8d68929a65b69047a88598f

SHA512
33a50911f7b8b5b981d0ed42e594d190c8ac476a48f2483e458422d9ebc87fa43a0a6d100f4646d8f1d42c729d6565835f36e42dea20e1cd3ee0dce1c2c92641

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
cdbf8b6c319e13d43e43bf0b6db07b02

SHA1
762e0b19f01329575fd11bcb924602e7e756b669

SHA256
bdaa1f34fa872e077a25c3ef7dbd8a45d44ea595d3eaeeef0ac15e8a4e4f18f8

SHA512
1deea8f4754b208e16988e47581b00a4c0fdd3b8b0a84208f3b378ec3186702fc2976f3a5cda929e6649ab9ac53f2fb76a7a1d2b6ae0c49c6f44e17b62726aa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a013febb79fc68aad16e6675e0603226

SHA1
ad23096d1b072a830b1a7c31b354f50209b16da2

SHA256
5ba497c15d5d3363d139142279c107e909a0664f7c2c843d31012e19166add7e

SHA512
e61368745578f4e12810d9bcbc84a1a4ff75cca5fbec1d7f0ec22551983e92814c97dc9049cad9bf3bd9482f741b192b550e83e3f6bf9adfaec3d5fad9378fcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
875B

MD5
cdc5e864161b0e4bc28aeea0d99ca178

SHA1
2fe996f0ff54bd0686eaf126f8e9c04f3d4bb958

SHA256
2c6bcd200330b8361a6b835efb1d34d803533fdd2af1f2566eb5114c08b4ee9f

SHA512
e5d491773f0e8390897b3041c49d2ce42fd33fa87b1e755b09c0306cba9b40540e77fb0c243304164867531f8d633cb0922f24527a6d907c3f5b16bcf60a64e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
b8845e5d69e4c301c35991e812aaae4e

SHA1
e30ad067af745ae5155d162ad1eb1860cde6fd83

SHA256
2f14e36459713a5c1a8e2915f54d29991f1a502b560806ab0dd5e7911578a6df

SHA512
d7823653d2f8064d1f228e3e8717d0e41b6fad847192826b01267b75af5f456ded223422400eaf13ab979dbedc767a6fc81183f3792eaa3795dac4d6f1145547

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4c03353bd965841847a480a883d6f309

SHA1
ab0b87bb7cba1e1e58a01362ec87af484359210d

SHA256
5b6d2a414001dc45f5cea616f32b6632738a01e20ce3bd44b35c3289f814087a

SHA512
064e286da4fb61c47d808319b831ef7390b3c112ec2497e45461454684b98bb9bb45c8cb9bb0731e2982705b83b1c0a65cc3727145cc3bb6c32781ed0cfea79b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
30f685ad60e404e2dab574d209fb6be4

SHA1
a59220fb11cfa31ad3c9d8fb85fbf278dcee8669

SHA256
0793b89a5189a07f8b55d9cdffbc99606ef63d518441b81dcca6d57026134b76

SHA512
e3fc9746ff96b11120f5ff7a4cfc0eac2bf3edf6a06b8190bffa6fb72bfc1ddc25786ec621cdb7b3b9f4d57cd71ede00bb92dc599759a7457d57c1af568cd5e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
337de464ced1a55b32bb80ef875a5200

SHA1
8e4d2b0196d65db4b9db46a6bfc6a2db1617c3a2

SHA256
fff58e9f703fc145ca51bbb15501f5e51025a99bea1969e62c9dc55a93d289ce

SHA512
bfc94d941c8eb1fd0e942ad4e3d8ea855dcec1d895f03c7ce4c918ca5433f7f8d6bf3241d8c3cddcc9c2fc33b1c41097dff60a546a9623f8b31d21286719ae87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d3d94120d03010022e98faa1206101be

SHA1
38dbe7575c81fc59f81e6f115d616a9ec47e4c41

SHA256
7c5ec350368f0706be2b3ea031cdd303e7b8eda4cfc2c04eec947c779346d343

SHA512
6d7a59963fbcf2357907c495811734e37bb20fd757b3b06224290082a127b9758acec1789881d06b167ebd3959cb363374c9168899d7a9da3dbddb8acd4d8986

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7c231da809c66e094db25db5cf79fd1d

SHA1
57091d9904d17314022c923306a56ad64f55e9b4

SHA256
207b36ce7de61ee7d88c9da436e7581cfdc4d69523828773a0a58d8d996032fd

SHA512
938491aa38becabbdc18d5c1f02283e694190cdaa67858e74eb728b8522a3eec73facde33e847ca4d0d6d2209dc90f3499840d98acced0b9ec14ac6fe15c2039

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
13425225dc78b3ea26e1909156a79deb

SHA1
a0e84b54f0bb963b06f5c530003234e13151c34f

SHA256
5aa6c6cced0078672f32b20267b88fb53422c817189445f3e4c9d630f0a94eba

SHA512
913cd38d789d3729d26a541f6005cede58907b25bcaed9c742fb6610f0b1678cc86597b82a8072f1d5f478000c59db8eca12f86e4110c8e57d7ef973341d2fe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
daad17ab4c16b00ee6d01782f114f900

SHA1
d8656a628800cecf489e20dc576560994299b610

SHA256
f4d90f53bfd34dbc5b129de2bdfec0451f8ceb67724cfb0aa9fff02b1352894a

SHA512
01983e896c70b1dc691c16153d993b397d65d65bc89719f514f4eb3007d6d15224396b025a21420fef9ef85070415fa53ca28d71df4de036046620e921eb747b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b0a398af8f45a5a6659e91c5e242379f

SHA1
f775784df8229cdd6d0e7d8e684298c7eaa7d1be

SHA256
53b16588bd7e05475fa885203736cf1803c304ec4ed1ba33f9d028465026c06d

SHA512
39592576e8869d6a49985591740afdaf22d7bcb6a1dc0edb3b113e8875c532ca8383151899d01cb3d82c8456b5e157b18936761bc671b8b3f054effb17111202

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe585bc7.TMP

Filesize
120B

MD5
c2b13580e2cb3db7e5027fa7b682e1f4

SHA1
cb08180fa7b76fc1ef9b7c544f533e88b6b5b463

SHA256
c1808db6685eb3f0e41620ed184f1d146c0d9cf9ee3181b817263bb730d4c096

SHA512
5094de7677e452203538065a4ed34d90772d02875bd18a6f42a63c13a779a3410b61ac94a67b20d75679fa819aed1f7d5a269f690497003e53fcbc3bbb086c03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
74ebfd98a7a7374d3a8f59a370f4b89e

SHA1
759af17b5a132d54ced486127725262dad46b6de

SHA256
848d210ac0bf3474ad21ab2de9acd4506cb53053fe41c03dce697e58120ab120

SHA512
92071e32c46b833b1ebaed186fe5bcafec91b9326723500fb33cf68a12edd480b5307c16e393a0d9a8f50848ffee3ff9cdc123eeda16a8066878ec81009ab396

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aceda.TMP

Filesize
48B

MD5
8d498ec6c7a821d5355779af0ab4cea2

SHA1
fdbf6423f80b94c0422719490692df55394751e7

SHA256
d82c567f4cf0359ee465c6788ac69f06c98f14ee5bfc8cd2c35433c51820c0b1

SHA512
ebe5fe9356ac754976e80a7d6118faa0a0926a7c39a2e5f33806ffc986e1435da14a7639ffd4a3a69f97a01e9b9f938cb918f6a4cf2224c1bb93a81e2ad076a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
21d8eb2415e3d2ae1a1bfba4b7ff1a1c

SHA1
609f9d57a1cba2be7cb601477cc806ee46bb289d

SHA256
120d373461226d77da5c40771cc0c7d451ddbd32c645d02c01abf008c6bbabfe

SHA512
fa90dcd6df54077b24de57a8e0134be28130ec5499e77afe2c29179d201c0bb1c22a262ab3cceb49c3c9e6f43b84a0344b00a85d5641f503ad6d618f335b123e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
8671599db2a056829de5a6be1af2514e

SHA1
74956d1274e9133a807b928b661961b37c256ac9

SHA256
f1c7a0c4b101ccebc9f2e5ca7699904a3e89ce6bd6d3373e0d2915e147eaf002

SHA512
cbaf286965794067fa0ea04818afcb7e282616cb0ac3a099d0f08f62eea14b65b0f0746a8b705677f085b2370bdbeaeed4b80c3b555dde0553e7beb979ca09cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
804b97160ff9fd4ca0efb1882bb42bf9

SHA1
b24936363f7ef40736c2b341cfcc4a078988321a

SHA256
3b87c0ec850c444e83f32e33974df08cb5ab93e1e5ffef63e5058e3c2a2f040a

SHA512
03fd769f1a111f71b68c02b0873ad6aa11df48feca6610abe2023701141c6881411bcc68c5810db100c7a84dee030a8558273e1221ec20384598251d0f5e2399

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
fd33135460a1433c40e926d4c070eaf3

SHA1
42a0d39f9f62563d6156e24c47c0eb6a3ec45bac

SHA256
dfb4bcd35d699ac29ce49c6458d6a102b4e959cd73d392093974d686643488c8

SHA512
dbd53219ef1c8e722f1dd2c6fbea9b63a21271075396240d0172a3e8d3dab2c68c3b75f9a7d81a9705340f690248d70d9ec942c9e0758f41d5f9c36c27cd6cee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
111KB

MD5
5c97638654bd8ac936cf10b39278fefe

SHA1
9c9626df3bb86be0263d5b7fd948531836a67a4d

SHA256
c6199a619c6b8766b93917b16f927865f910357900b98218449cb54726f3063b

SHA512
69123711ad9888722717862407b22aecf1f21267f54f6357841bfbca036c7de5a36d4a8c3433b95510dacb50c91161535a4b98f75246b28c4e5eb45c2080e18c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
118KB

MD5
c4a6db103276e08c00e89d03400cc067

SHA1
041df6770be6bee91b19b4342277512233d5e6b1

SHA256
714479d6bb57627aff1278147cf197eecf1cacb2814ce0a4171cbc1cfe4b6b64

SHA512
26e27f59ab939dccfd1f3122d60e167470a96fea49bd57c5c536ce3217f1038545aa4557ea43daacd9e31ba350288b1279f854547c0d1377e54cc05e4ff895bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
115KB

MD5
f9b933796ee91e1209fb5085c02b6268

SHA1
f5cd578900abdf63c34e72ab0d6d0abb9a040af0

SHA256
07f92798d287a1cf4951ec30c00f30fc521348171e5c38b10c121524d9069871

SHA512
f480acebfb6cfecdb635203d10d85540c70f89af2b639e424d47245b8824b5297e53ce1e9f6c4e61a1f499987dc3c692d842d709ef228d7398fee76db29b14df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5813d1.TMP

Filesize
107KB

MD5
a80a063f963704c3694f67656581f0f5

SHA1
cf0ba3fb12e4b11f6be5b10ecaac42531945267c

SHA256
9d7cb9163954f28b7e597ed87999f4787fbacdc9eb1de0f86b3ff9e67e7b92d3

SHA512
d9f4539e14710e0296ecfaf04069e197bdcb821268c0e6af8fdae952595960360c8fc01f01fc160894e6337db067704da781a2d11d08ef897005623da93bc125

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Downloads\260723doc.pdf.7z

Filesize
5.0MB

MD5
c5b9b50905e1633a22969e2cd6b3e58a

SHA1
bda05ae9fcc2fe7463c533cd42f97d45c971e273

SHA256
62e64a49b181b7118d41b7f82958365ebe806f92311a77a8376a6567ec0fb1d6

SHA512
046e87af95f1c100b9d82bafea7d48ba4239678f5196d6dc9ee1efd6648a2fcdefc81c667216ca75ee92f6734090f559aba91af7669f47ce9ab54135a826f40d

Download Submit
C:\Users\Admin\Downloads\260723doc.pdf.7z

Filesize
5.0MB

MD5
c5b9b50905e1633a22969e2cd6b3e58a

SHA1
bda05ae9fcc2fe7463c533cd42f97d45c971e273

SHA256
62e64a49b181b7118d41b7f82958365ebe806f92311a77a8376a6567ec0fb1d6

SHA512
046e87af95f1c100b9d82bafea7d48ba4239678f5196d6dc9ee1efd6648a2fcdefc81c667216ca75ee92f6734090f559aba91af7669f47ce9ab54135a826f40d

Download Submit
C:\Users\Admin\Downloads\260723doc.pdf\260723doc.pdf\Nuevo_Documento2607.pdf.exe

Filesize
6.9MB

MD5
c688b50e5b47539ab29e4e748737391a

SHA1
24f9be8db519190abdeb4e211c5be863c31f349d

SHA256
7fccc0fd1db4123276163e62b4b152efaebe17228a72e1d91cc0109a61a247be

SHA512
af672fa317e62e32cd500567910501f00b693549cc7b1d120830b0c7754f3a86df4b435998f14259da268e4a2ea5cc40e324875a4dd3f7399c738360fabb37fd

Download Submit
C:\Users\Admin\Downloads\260723doc.pdf\260723doc.pdf\Nuevo_Documento2607.pdf.exe

Filesize
6.9MB

MD5
c688b50e5b47539ab29e4e748737391a

SHA1
24f9be8db519190abdeb4e211c5be863c31f349d

SHA256
7fccc0fd1db4123276163e62b4b152efaebe17228a72e1d91cc0109a61a247be

SHA512
af672fa317e62e32cd500567910501f00b693549cc7b1d120830b0c7754f3a86df4b435998f14259da268e4a2ea5cc40e324875a4dd3f7399c738360fabb37fd

Download Submit
C:\Users\Admin\Downloads\260723doc.pdf\260723doc.pdf\Nuevo_Documento2607.pdf.exe

Filesize
6.9MB

MD5
c688b50e5b47539ab29e4e748737391a

SHA1
24f9be8db519190abdeb4e211c5be863c31f349d

SHA256
7fccc0fd1db4123276163e62b4b152efaebe17228a72e1d91cc0109a61a247be

SHA512
af672fa317e62e32cd500567910501f00b693549cc7b1d120830b0c7754f3a86df4b435998f14259da268e4a2ea5cc40e324875a4dd3f7399c738360fabb37fd

Download Submit
C:\Users\Admin\Downloads\7z2301-x64.exe

Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
C:\Users\Admin\Downloads\7z2301-x64.exe

Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 907922.crdownload

Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
\??\pipe\crashpad_4396_WGEWRQDTRHOHGDOO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1820-730-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-1033-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-731-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-729-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1820-728-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-1027-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-1028-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-1029-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-718-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1820-1059-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/1820-743-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/2860-1035-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1048-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1032-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1036-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1037-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1038-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1039-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1041-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1043-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/2860-1034-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/3444-1045-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/3444-1046-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/3444-1050-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/3444-1052-0x0000000000400000-0x0000000000AFB000-memory.dmp

Filesize
7.0MB

Download
memory/3444-1031-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/3648-1121-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download
memory/3648-1124-0x0000000013140000-0x00000000140F0000-memory.dmp

Filesize
15.7MB

Download