1556ef60b8023750fcfd9ffdae75df500efca8d84bf7b81f0aa54fe91277f568

Analysis

user interaction
yes
max time kernel
354s
max time network
355s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Factura de pago_FAC-2026-001A_pdf.exe
Size 1.1MB
Sample260511-11a8daa18s
SHA256 1556ef60b8023750fcfd9ffdae75df500efca8d84bf7b81f0aa54fe91277f568
MD5 3475e285b6055a01fa5c74f1440fce7a
SHA1 0792380e67ae653a7b6c7790f01b2aeccb5c2b3a
SHA512 fd515309ce48c67a6d3c63083a15d0b03e0f0db2cfe168d5a300111e87e8eaf7eea5f309d59f4d3029055e2eb9d62d26b706cd2536f0be3781558b431c7c4189
SSDEEP 24576:D9bhzjMEvX/sR/PTeq1B4RnNr+lrQ1Q4RAKnC5G3knmOmrbmMlQ8Nu1c:RbhzjMEvX/sR/PTeq1B436lrOQ4RFC5g
TLSH
T195452382259EE427E1DE0BB059A1E17867709E9CDA20CB07FFD87FEFB476B640105242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6020	powershell.exe
5804	powershell.exe
4348	powershell.exe
2864	powershell.exe
4332	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Factura de pago_FAC-2026-001A_pdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Factura de pago_FAC-2026-001A_pdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	kbXZJcfCg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Factura de pago_FAC-2026-001A_pdf.exe

Executes dropped EXE 1 IoCs

pid	Process
420	kbXZJcfCg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbXZJcfCg = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\4x3qtd4c24p.ps1\""	Factura de pago_FAC-2026-001A_pdf.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5008 set thread context of 4336	5008	Factura de pago_FAC-2026-001A_pdf.exe	102
PID 420 set thread context of 4268	420	kbXZJcfCg.exe	111
PID 5300 set thread context of 5520	5300	Factura de pago_FAC-2026-001A_pdf.exe	141
PID 5792 set thread context of 2840	5792	Factura de pago_FAC-2026-001A_pdf.exe	146

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Factura de pago_FAC-2026-001A_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Factura de pago_FAC-2026-001A_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbXZJcfCg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Factura de pago_FAC-2026-001A_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5668	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230109122440384"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 = 4e00310000000000ab5c21b1100054656d7000003a0009000400efbe3e5cb902ab5c21b12e00000084e10100000001000000000000000000000000000000db3aed00540065006d007000000014000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 820074001c004346534616003100000000003e5cb902120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe3e5cb902ab5cd5b02e00000070e101000000010000000000000000000000000000007fa311014100700070004400610074006100000042000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\NodeSlot = "6"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 50003100000000003e5c270f10004c6f63616c003c0009000400efbe3e5cb902ab5cd5b02e00000083e10100000001000000000000000000000000000000c664b6004c006f00630061006c00000014000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	chrome.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5008	Factura de pago_FAC-2026-001A_pdf.exe
5008	Factura de pago_FAC-2026-001A_pdf.exe
6020	powershell.exe
6020	powershell.exe
4332	powershell.exe
4332	powershell.exe
420	kbXZJcfCg.exe
420	kbXZJcfCg.exe
5804	powershell.exe
5804	powershell.exe
940	chrome.exe
940	chrome.exe
5300	Factura de pago_FAC-2026-001A_pdf.exe
5300	Factura de pago_FAC-2026-001A_pdf.exe
5300	Factura de pago_FAC-2026-001A_pdf.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
5792	Factura de pago_FAC-2026-001A_pdf.exe
5792	Factura de pago_FAC-2026-001A_pdf.exe
5792	Factura de pago_FAC-2026-001A_pdf.exe
5792	Factura de pago_FAC-2026-001A_pdf.exe
5792	Factura de pago_FAC-2026-001A_pdf.exe
5792	Factura de pago_FAC-2026-001A_pdf.exe
5792	Factura de pago_FAC-2026-001A_pdf.exe
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
940	chrome.exe
940	chrome.exe
648	chrome.exe
648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	Factura de pago_FAC-2026-001A_pdf.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	420	kbXZJcfCg.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeDebugPrivilege	5300	Factura de pago_FAC-2026-001A_pdf.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeDebugPrivilege	5792	Factura de pago_FAC-2026-001A_pdf.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe
Token: SeCreatePagefilePrivilege	940	chrome.exe
Token: SeShutdownPrivilege	940	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
316	chrome.exe
316	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe
940	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4336	RegSvcs.exe
4268	RegSvcs.exe
5520	RegSvcs.exe
2840	RegSvcs.exe
316	chrome.exe
316	chrome.exe
5448	chrome.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 6020	5008	Factura de pago_FAC-2026-001A_pdf.exe	100
PID 5008 wrote to memory of 4336	5008	Factura de pago_FAC-2026-001A_pdf.exe	102
PID 5008 wrote to memory of 4336	5008	Factura de pago_FAC-2026-001A_pdf.exe	102
PID 5008 wrote to memory of 4336	5008	Factura de pago_FAC-2026-001A_pdf.exe	102
PID 5008 wrote to memory of 4336	5008	Factura de pago_FAC-2026-001A_pdf.exe	102
PID 5008 wrote to memory of 4336	5008	Factura de pago_FAC-2026-001A_pdf.exe	102
PID 4332 wrote to memory of 420	4332	powershell.exe	105
PID 420 wrote to memory of 5804	420	kbXZJcfCg.exe	109
PID 420 wrote to memory of 4268	420	kbXZJcfCg.exe	111
PID 420 wrote to memory of 4268	420	kbXZJcfCg.exe	111
PID 420 wrote to memory of 4268	420	kbXZJcfCg.exe	111
PID 420 wrote to memory of 4268	420	kbXZJcfCg.exe	111
PID 420 wrote to memory of 4268	420	kbXZJcfCg.exe	111
PID 940 wrote to memory of 4556	940	chrome.exe	121
PID 940 wrote to memory of 3908	940	chrome.exe	122
PID 940 wrote to memory of 3908	940	chrome.exe	122
PID 940 wrote to memory of 5668	940	chrome.exe	123
PID 940 wrote to memory of 3332	940	chrome.exe	124
PID 940 wrote to memory of 3332	940	chrome.exe	124
PID 940 wrote to memory of 5104	940	chrome.exe	126
PID 940 wrote to memory of 5012	940	chrome.exe	127
PID 940 wrote to memory of 5104	940	chrome.exe	126
PID 940 wrote to memory of 5012	940	chrome.exe	127
PID 940 wrote to memory of 5328	940	chrome.exe	128
PID 940 wrote to memory of 5328	940	chrome.exe	128
PID 940 wrote to memory of 5304	940	chrome.exe	129
PID 940 wrote to memory of 5304	940	chrome.exe	129
PID 940 wrote to memory of 2840	940	chrome.exe	131
PID 940 wrote to memory of 3068	940	chrome.exe	135
PID 940 wrote to memory of 3068	940	chrome.exe	135
PID 940 wrote to memory of 2244	940	chrome.exe	136
PID 940 wrote to memory of 2244	940	chrome.exe	136
PID 940 wrote to memory of 2192	940	chrome.exe	137
PID 940 wrote to memory of 2192	940	chrome.exe	137
PID 940 wrote to memory of 4844	940	chrome.exe	138
PID 940 wrote to memory of 4844	940	chrome.exe	138
PID 5300 wrote to memory of 4348	5300	Factura de pago_FAC-2026-001A_pdf.exe	139
PID 5300 wrote to memory of 5520	5300	Factura de pago_FAC-2026-001A_pdf.exe	141
PID 5300 wrote to memory of 5520	5300	Factura de pago_FAC-2026-001A_pdf.exe	141
PID 5300 wrote to memory of 5520	5300	Factura de pago_FAC-2026-001A_pdf.exe	141
PID 5300 wrote to memory of 5520	5300	Factura de pago_FAC-2026-001A_pdf.exe	141
PID 5300 wrote to memory of 5520	5300	Factura de pago_FAC-2026-001A_pdf.exe	141
PID 5792 wrote to memory of 2864	5792	Factura de pago_FAC-2026-001A_pdf.exe	142
PID 5792 wrote to memory of 3844	5792	Factura de pago_FAC-2026-001A_pdf.exe	144
PID 5792 wrote to memory of 3840	5792	Factura de pago_FAC-2026-001A_pdf.exe	145
PID 5792 wrote to memory of 2840	5792	Factura de pago_FAC-2026-001A_pdf.exe	146
PID 5792 wrote to memory of 2840	5792	Factura de pago_FAC-2026-001A_pdf.exe	146
PID 5792 wrote to memory of 2840	5792	Factura de pago_FAC-2026-001A_pdf.exe	146
PID 5792 wrote to memory of 2840	5792	Factura de pago_FAC-2026-001A_pdf.exe	146
PID 5792 wrote to memory of 2840	5792	Factura de pago_FAC-2026-001A_pdf.exe	146
PID 940 wrote to memory of 316	940	chrome.exe	147
PID 940 wrote to memory of 5220	940	chrome.exe	149
PID 940 wrote to memory of 3420	940	chrome.exe	150
PID 940 wrote to memory of 2140	940	chrome.exe	151
PID 940 wrote to memory of 5448	940	chrome.exe	152
PID 940 wrote to memory of 648	940	chrome.exe	153
PID 940 wrote to memory of 4160	940	chrome.exe	154
PID 940 wrote to memory of 4160	940	chrome.exe	154

C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4336

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\4x3qtd4c24p.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Roaming\kbXZJcfCg.exe
  "C:\Users\Admin\AppData\Roaming\kbXZJcfCg.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kbXZJcfCg.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1096

C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5520

C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura de pago_FAC-2026-001A_pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa016cc728,0x7ffa016cc734,0x7ffa016cc740
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,2988585808336892533,17283402663449675450,262144 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,522913314043688740,3661558636680207615,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,6427432041154268901,2299500287731915997,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,10268028844851626843,16783072587199188043,2097152 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,431417756799447376,868031071684254571,2097152 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,6995863050535887772,5404273306434065056,2097152 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=1692,i,17048431266841675995,3743975919031039230,2097152 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,15864664369285914055,2914515986295838708,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5788,i,377359879124491593,15235220373704779861,2097152 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3644,i,1948631804979770776,6488134026227630142,2097152 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,7222555967090083072,5222631187778844321,2097152 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,2108997454435583299,10073464181584612014,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,15366667422083014547,8933600188755812810,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,2531391048594433239,1529562407920011669,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,10453687979655622139,8545112709228375037,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,14617083226429309521,7530824682468713589,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,12190661419777084004,5930392428999172502,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4456,i,4067753285483958476,13900395453335565814,262144 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,5413134066330277451,8361258743964415705,524288 --field-trial-handle=1944,i,14152600296780710120,16924031980278581870,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ab70b911b972384c33f866de04adcdf5eb846887be7962dfd10ae97208da0f7f
MD5 c89947a028520e6815eceeb2f7554ce9
SHA1 44676a4174e45a7dc1e0838cd927ec2c6f51f8c2
SHA512 5c640edaa65e3bdf48e9cd3d76d5f377755fa016e443aa4e05084916bff19e5e060075f68237586f989b5bc52ae83914f67fff7638a371181bb3c807da71a8e5
TLSH
T18BE02BA7D962EC270CFD1B296464470AEF5013572B41551F7A3C960C8FF123B458281C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 50KB
SHA256 3ba1faa7a91e1ac4fc99bc5bd4002b4ce37a4a98996c8f59c35c2058b53a24ac
MD5 d69fe86ae540013d7a6747c5aa138c6b
SHA1 519e0e3e73924fc28e1c37f987bb77a4d7a7e05e
SHA512 70b9a70fd38dc551087f69c6e2befbe06b42e418f32f6d62d04b734646dfe547eda5a0a01d4d5f96ec68084cbca1fdd888ff5de4252378e02289b64e750057de
SSDEEP 1536:prlRNSB7IYsT/6dnxfbFyGlursNaAfkf85Eu:zfSB+/6dhlluYNaRUKu
TLSH
T16E3301667DF542938B77B1D6B3E72F6189F3380C962B00F0A41CE71BE6072D4A950476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9fb49f4031ea9e3cd2c00e1d8ddb42d0076552a398e4407d9b850394435b768e
MD5 57f24bbec8603efb62b2295e360041c6
SHA1 d3c0b83ab29cd0afd388c2b0e293d481d4d41b55
SHA512 537ffa7a66a13e087e83471088d23f3d5c1ed9f3e0f6290f0554cabc0d3be819fd5ccb6a748cd3c064a201d46fca5b5e74fe980f8e9cfdbd8ffc00c216fc5995
TLSH
T113116D8574A7D065DF2249BD41E6CCC838F175BF0786DF3B2757812A7063BB1A0D426A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 90b2a097d42e264ea56069276bf7010f9fc8cbbaa2e142806dbf55ee066e6131
MD5 e6dfd7c3a20d7873753326b1f83a6d5b
SHA1 f66bf3b04f5bbe1690d17854b4ac917e4b4fec62
SHA512 98597a856f148bfef16b9fd09a0c26194d8b67c4a7b704160b41d409720ff5e81dec5bd01446ed947cb2134c49f5888e5a55495d46ec3c7f628214f65d8e95ba
TLSH
T19211458578A7D061DB2248BD81E6CCC834F17ABB0782DF372757912A70A3BB1A0D4266
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2239958b8d3741d68349965a8180b2db9210fedff66ad35d6e90a8a57505fcfa
MD5 eaa99db4ed10c9b94b8405ac7d4ffca4
SHA1 44986cedcf9fc613d2b59f0ac13dd82fc8560e3b
SHA512 852214082003a7a6051f9a7aa8af794ada49cecff6ad8b42db0077309b2c4e53bd2488feaf785717d0adc0ef4e50e48e27a97f776c120f5104bfce6dea355f1b
TLSH
T1F331878C78E78164EB2609BC81E1CCC938B135AB27478FFA12138139F1E2BB190D0366
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 184c955378db2499265eca21812ef0a6e5ec01715475a9b98d2e7ab98fac7bb6
MD5 75df058aa1687af9bd6f4bc959f11955
SHA1 9c3f8c571ca4118c183fcdf9f696174c2b74a15f
SHA512 48b37872bf4b9e3af5aab173ab65d1cff550c89c5926626fa6e9bc56308e4c11ffa19321ff826a3100ef64290933cfd32492d1c6d5eeb1c96e60ce624b5bfa76
TLSH
T10841C89F38DF9015FB2209FC81D18F8834F031AAE2479EAA12034139A3EE7B190D0375
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 14e16f031cd3996a8e9d1a7afa1f4da301929b32ac467d78cab890925af78d07
MD5 e4b8bb4605fc8e261483414a2df77075
SHA1 cb5d2a71b50b358f81161e1a5a6fde6c81682f6c
SHA512 21b25fe829a7c2e1d52def1e1e104ff75e722b40a13b5926587fc5d329055ff190d2bfcb9109fe428e138f743fc24a23b0839a2ac633b293ce53ced75c1c8715
SSDEEP 192:DXan0+lVbBM00aMlfbsPHaaIVX15TtTUJ7I275qs1Yf5zFflI+dCL:DXan0+lVbBM00aMRbsPHaaIVX15TtTUH
TLSH
T143227DB3C3D4866DC91162F5DF247E2FCD6A0924536C3D6789E4EF4A63E2472E21128E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 e1aa18a4e923b5d4f3a20371b07f5617f85d69481037d849bc31deb842b9a340
MD5 dc2524af53b933a723862f54acf23b93
SHA1 3d89a828b102384e9a2a57f8384ed0137e6d5b96
SHA512 cc3f985c6be4373070e555ecc6e11ac6b158e346e24822a365c6f5f35dcdcabcdeca9e66691e111b06c8c39da8c6ac003a8e89b134057ad442e0b36a9489ad41
SSDEEP 192:DXan0+lVbBM00aMlfbszaaIVX15TtTUJ7I275qs1YfBEtzFYG:DXan0+lVbBM00aMRbszaaIVX15TtTUJP
TLSH
T151227EB3C3D4C66DC91162F5EF247E1FCD6A0928536C3D6689E4EF4A63E1472E21128E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a1f7ac266eb9dcb257fe1eefdd8702e2b27a41b7f8dfe5e7cd0ebf7b3f87bf3c
MD5 b37a924c3a9153da33cdaad63334c54f
SHA1 c66d3922b12d9d84e454d9bfb7fd354da63b3220
SHA512 5964267372468e2b5fc41bea0f77f3cbf1cfd4996e2f20fa1b1cad86875526ff6f7df18c59d105c32ff74ddd01171abaa0eba1a31dbaba9a4e50f3cb66be5a31
SSDEEP 192:+RYcBz0hVkfwkd9v7japAPRp2G2Y+C9mHsb+WNXHVh4Fx2sR0WIljVyIsnAUgtaJ:+RYmz03kn9aUXXIwfs2QMP8
TLSH
T1CF52D96AB910697B9CDBD21AF972B757D7F6202164841EC4EAFC8A3C08D76CD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ac0aa82e2eb94d6c6aad5f847ae4ab4931b4ce0dfc0dd7875a8c216f1f37f069
MD5 bf8ab0fb6c5b6ac2fd55e635c6736b8d
SHA1 006db83afd737af08e849932f350364183dd7ab5
SHA512 074f170b7c125fa8601885a8b3b93b52e53817ee1dc77e4604e115908c1e678f5d4da26367afbd281416c6bb217c440eecaaecf341f90cfb279c8d73683b9d0a
SSDEEP 192:+RDcBz0hVkfwkdHv7japAPRp2G2Y+C9mHsb+WNXHVh4Fx0SSovR0W6ljVyIsnAUp:+RDmz03knPaUXXIwfs4o5mPe
TLSH
T1E152C86AB510697BDCDBD219F962BB5BD7F2202164C41E84EAFC8F2C18E76CD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cef2945392f8ace4b08ae6c23f63774e8459f65801750e321dc65c3fcfc032f2
MD5 c424c6759bbef9b7ebf2fa91112398d8
SHA1 c00efde87eef360207d0ea31d942391accccc4a3
SHA512 ee7b64f5df22a48ccf71785cdb3fb4134662b400246a0b69e077ae309403774f835d7a407012b6171ed501088cbf30b50b8cd630e92301358f0a85065964287d
SSDEEP 192:+RYcBz0hVkfwkd7jv7japDPRpTG2Y+C9mHsb+WNXHVh4Fx0PrEbR0WuljVyIsnAq:+RYmz03kn7ba9X2Iwfs4EtKPe
TLSH
T1F562EA6AB510697B9CDBD619F962BB1BD7F2203164941E84EBFC8F2C08E76CD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 25067f53afa2e639187274a89cee347620b6864153c62d55e2e9b49dd17b9a91
MD5 9a0547fd4b4e50c99beaf1618e5261b8
SHA1 e18cb3ec933083d21c9750e06404ac9d6382a075
SHA512 caf20a8ceda6774344982bc15a48c45f26a1a133150391feac643d9f5c859658f7c1d026a07c305e6efc94d8643b0f54bff61034fb8b7143e7fff6d9a5656fc6
SSDEEP 192:+RYcBz0hVkfwkd4v7japDPRpTG2Y+C9mHsb+WNXHVh4Fx0ONWSR0WuljVyIsnAUp:+RYmz03knka9X2IwfsPWOKPe
TLSH
T13562EA6AB510697B9CDBC619F962BB5BD7F2203164941E84EBFC8F2C08E76CD2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 168KB
SHA256 ff5508c0de843c6e2ef4f6c011c8644137b23c11e37ca45f0a6da53b9ffc0101
MD5 c4cf8f42c3a9d1b16691db14ada07891
SHA1 7136df0de330dcd855e4da159b043e3f64732fec
SHA512 fe3aa293088dc3cb9fe87b0758de6ca6008eee03c4215b80f76deca46cb0d3d33b9c76150ddc7c52f206e178cc7d108a2d1397e1de227cd4e421cd73cac93c9c
SSDEEP 3072:+Qe+sswSjnxPCA1jgwiRPS5NvawiHvwRUt7m1KULC1rTg:+cssw9PS5MwCvwRUbTBg
TLSH
T187F38346D1F8D863AF7B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 cdc401ffa2e3a61de3edfb383f8fdfc11cee6a8e3bd7186651a7ad297255fee3
MD5 894f67f19dcee850b6df8555b364d0b5
SHA1 4d1d7b26028a90f98dc0bbd78108f3743254251c
SHA512 0080f0b04f3c3392cf8ae775d2b852a334f51d2bc96771e78ae025fedbeb89b786f2ee4976c692594d6be01f02273c4c55561b80cad945aee56612d186c1c418
TLSH
T1E8C01251CC03A172C04703F528939D9CB118DF34DA050B8C57F16A77DC35FA24118355
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a29b1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a29b1.TMP
Size 96B
SHA256 3b91129eb9a1ac2cb2495f3c651e4f404900eaaad5fc38090d0a6f1bd82074de
MD5 5b35dd8d5eeef39def71a03b68548f2c
SHA1 d37c2ab75cdb8f2681560d3516b70fede58b68f6
SHA512 74d3f3fc6197fdb992c1a175462010406ca77faa0c07cca37a73b566e89602eb16125fb14c23c83c67b1fca1bacb7bb44438021dcd09eb32a6bc948378775a6f
TLSH
T115B02220C0032303C00203F028A0A8CCB030CF23C2030302C2F00A2AFC20F308020022
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a661c71584fb067d0df63917b468473ea34a179a9f491639caa23c0a3a64a7b5
MD5 c6aa1a46f3a49f4e719458abe0d9bbd9
SHA1 dbf9cb3469f61e4357d05e4f507af739d41eb12a
SHA512 071ca25e41dfa03166d3a5e8827c64a873b6b095f53b7e75049c421f4197da5cd729ea4b00e9aac9a7d70e49b7f32b5931517897914d3a4d5a35b1d59f2bc14d
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2wj96Pjq2Vump8w95:jeuvBnhJsueMEGvIW1DcP24IHVump8m5
TLSH
T1D0D3A84B3A747102EDE59A721CE051BB5E3CB16D8F1595D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 7d760e9ee921044148d42b95d0defa876bcc3b71f495f881839efb977ce9097a
MD5 41dbebfc6a306d5fa9bed6fb9ce4b9bc
SHA1 c7d4b6b5edda41cf48e8c7aafe6c19fc06a7a665
SHA512 721f327ce4ced1f98b645ef9fc05f94aec33d7524e8c3ca629936830ba104c3da95f2122b6b75940eda4b474546984eebbf2b13a5fe270111201dda20133932b
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2wj96Njq2Vumpfw95:jeuvBnhJsueMEGvIW1DcP24CHVumpfm5
TLSH
T1C3D3974B3A747102EEE59A721CE0517B5E3CB16D8F5595D438B620688EF2823B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 0e1a6f498fa5c2f22c75ffd35b891c05ef27a49fce412e1b480a1d55d1809305
MD5 2939f3c547bbb0bee86738a960e22263
SHA1 6d76cc2568797a05bb9e6adb6fbfa9a2a480955d
SHA512 727167d88281e9f56b0d6bd2563694f6cbe350aa3f7a7f94f198eff78b2f956444363cf41d5df9be7cdce1f6d42b4f53559e41a8b2f1a82a32cdb260fe3832b3
SSDEEP 3072:0VNWWWbCGr3o3ssveOsjYiVNmhfL3Qw/xLANk0mUW5GmRntSFCjEENa:02WXbssWOsPKhzrOk0HOGm/SFyEEU
TLSH
T1E71412245B1A1F8AD2FE459E280ABB4DCD229709B307F8DD356887442AE23C91755EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 b0af16ff47a209312876491afaf53e5789f33dc3ef950e83a8edc3c1b52366af
MD5 ad8301293485227aaabe81cfaf0076d7
SHA1 1bce57d7ce78014d1a0e910c3986af642a1da986
SHA512 9341c53113ec647acce9711a1259a4b2852d1e31f9b55ad26bf57c819e1e8a47b9b4addec0b12c8f949223d81da0527313b009837579d707550c1c94ee8277c6
SSDEEP 3072:0pjNWWWbCGr3o3ssveOsjYiVNmhfL3Qw/xLANk0mUW5GmRntSFCjEENa:0pkWXbssWOsPKhzrOk0HOGm/SFyEEU
TLSH
T1941412745B1A1F8AC2FE495D280AB609CD62A71EF307F8DC746C87442AD63C81B55EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 069c250ebac0dcc604cdb4e9ed093733646c2963c63cd299c079eb2978537516
MD5 8c207821abb45345e299356424bd7cb8
SHA1 da8669e180283d74b80519d156db4266ebf0f332
SHA512 7b06fa13f52de259c6e010f15cbe299ac5193814abf3ae2c09390e8d2f20fad538223dc32d621fab32589f6b0565041bc82a53ec442179cae110af6d3e920c27
SSDEEP 1536:0cChcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:093Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T17B9302BA9E2646E7957E468176AE7808CE13130D709FA9CC325C639C21D41C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 e1172dd771ad2d3571005c40277963ea29420040072314b7aba87d20872da319
MD5 aa1915115220ff532e07e8a32c9e0d44
SHA1 5a0ec74fda4e154dfec69cade71096534709c59f
SHA512 a831c032c09cfa2c45efe5070c06e0f8e9c74ecc89980639bb1b588679d83597ecbeb9c921e22f8af8388935f3e82cfd4b1efc1e594fb3a15239d2e8ca238360
SSDEEP 6144:09NiFaZBqqWXbssWOsPKhzrOk0HOGm/SFyEEU:0TPf6bsHmrOjuGdF2U
TLSH
T1103422380B151F8FC6AE495D7449B7088D63975EF28BF8DC389C874819D63891B49AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 73b613533dc4aa4b017617d6388f12ad34ceff50820f34b2a3f7d8997168d16a
MD5 5710399f79f027b5040af35fe5e6288c
SHA1 e8430706eaacbbbd047116b84502d167a1702e83
SHA512 160da799a4e81b239f27e2dd77cbd50687340c2c1da7335e40455cb95bd6db00d0d7ce881d29fe6bbd5987fa3d82ac912d061ade7aa299c728fe1fabdc825828
SSDEEP 3072:0yNWWWbCGr3o3ssveOsjYiVNmhfL3Qw/xLANk0mUW5GmRntSFCjEENa:0jWXbssWOsPKhzrOk0HOGm/SFyEEU
TLSH
T1801412245B1A1F8AD2FE459E280ABB4DCD229709B307F8DD3568C7442AE23C91755EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 3666d6c619c7c452d3b61ac5ff294943b51f594fda3122d854c2f8b393f23452
MD5 851555fb1528d8f5801bc6d569665a98
SHA1 bef015bd296676955b38baa088d31765a4830e03
SHA512 2be0b0b0c78e59b73d408738408e867b5e54ca394522a7157910b14fd3f4353086cb6903fb8f79bd63016c7af25fe4b14f8cc975d0e97f419fbd756a6d55722f
SSDEEP 3072:0tjNWWWbCGr3o3ssveOsjYiVNmhfL3Qw/xLANk0mUW5GmRntSFCjEENa:0tkWXbssWOsPKhzrOk0HOGm/SFyEEU
TLSH
T1B51412745B1A1F8AD2FE495D280AB609CC62A71EF307F8CC746C87442AD63C81B55EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Factura de pago_FAC-2026-001A_pdf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Factura de pago_FAC-2026-001A_pdf.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
TLSH
T104219B303222B5D84D022F530C0869C513EF4759BB64EE2CB959231EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 74b0d8e852bdd0b33c876d68a124c5e65773429f8ad9b1c7f7baf227b19518e4
MD5 090e6febcb8d73e967fa2289e826913d
SHA1 c0f3ae9b81ac3e6d4663ae8bdee2cf8cf51442bb
SHA512 b11b5432705486b53d656cf8b36aa78b80d13a88ce1a3092cd61e1673ab9bfda68df18672da7d319fbb6cea91286e6fc3c973dddd240e3e232060c739bada2cf
SSDEEP 384:r6+B+9i+YWIDcPPiiQFho9o2TVK6seYLME/B03SoZ6fYSvojEDkSd0gdMtkKhD:ewWTKLSo2TVNgrqSl52EDOCm3
TLSH
T15382D76E611F16C3C48513B8E11B055FE8F2DD8D531A13D8BB1A9F3B8EACA9E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d202eded742528d53a8c12a4679124e319dc7e6974eb4876eb2ae435f9a46677
MD5 8a743e79f4b6595c3d80a1dbb142a809
SHA1 d23f62de1d2d5cb02104fe0e81a0354dc10b30d4
SHA512 8bbc4695d6b8206b944f725bcd44eb4ba81d6f9fb22c5c8e4c090e7cee9b01793c6e544808d263cfb82a7b3c985f5400d36c9022404c3cac0e0e84a6d6743e8d
SSDEEP 384:dsf+BV9910ucNOgBikFa/8KlLro9Q5FjpNY1aEAGZcYopz+4pKEE+nUSVkki0SO1:Cf40uXgoUKlLcQ5JpNntYB4pKEhUSikD
TLSH
T14882086D221F2AE7C4A613F4C82B43ABEDF09DCF934407DE57495A3706D977984A40E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7237b7bfd7e7f05a9dd785d3ada5711f96680f2647ee3fddc3a5f3b3579a2910
MD5 ef2db05969dec7469c23438b6021f30d
SHA1 e22d88fa5e3040498ee0b58d46c2d166acb6aad6
SHA512 efdb02bad2db764e0e9e53f2624cd475875a410c5205c75cec734592375072ee96889f4c30eb5761c8c565fe7e2edb39b0ac52c2aaa0c1e77c75c324af21641c
SSDEEP 384:Tsf+BI911WqCI+5BikAfTk9CQTUNY1GW0YApz+73dPL+nUqVkki0SO1:ofR1NGokXCQTUNYZ73dyUqiki0H
TLSH
T1C182185E210F2AD7C4A523B4E436039BEDF09ECE830517DD6B0A5D3706DA76AC0A51EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 255B
SHA256 381c70d9051951cbd2af89ee66b18a40974c37ae24e35b010f815713613f0039
MD5 7f28e0c31a90e9629ba8b3042a565164
SHA1 e80ce3f5bf00dbffa23cbfcc9e48d63b8126b79b
SHA512 d96c1454f49678858e5d9d8748e49666316beeb424ee3e189dc56451a0a329b5fa3038c01f78a2ac5aad52ca5a59d8750e58a2ca98248ee724ea99e95ea380b4
TLSH
T181D02330F34CC038CC56433590496611773552C500911BCF2580D4044C5F0444732F80
MD5 SHA1 SHA512 TLSH

Submit Download

4x3qtd4c24p.ps1

Path C:\Users\Admin\AppData\Local\Temp\4x3qtd4c24p.ps1
Size 1KB
SHA256 ae8d86109be52312e8a821f280c24a7c3f51520c59cbe576f842747311fd4937
MD5 f5265a121a883171293dd107a7b7a8f2
SHA1 e5e2524933bdb8749c92daf41d3277ca8ae835cf
SHA512 35a8c9c3fe896476c7b6f7987e92ac9ebf0828556c4e70bfcbf19e3b07c877b64f38ceb511525d77b8e8e786a2037949ebb651adb3d22e8968ebd950f911713a
TLSH
T18421EF0B8E8943C9006887F04A1331CCB06D61CB1B6F028099ECB4EEB32FD27342ACE5
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_whdoymd5.qmg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whdoymd5.qmg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LoginData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\TOTOBVWA-Admin\LoginData
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\TOTOBVWA-Admin\WebData
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kbXZJcfCg.exe

Path C:\Users\Admin\AppData\Roaming\kbXZJcfCg.exe
Size 1.1MB
SHA256 1556ef60b8023750fcfd9ffdae75df500efca8d84bf7b81f0aa54fe91277f568
MD5 3475e285b6055a01fa5c74f1440fce7a
SHA1 0792380e67ae653a7b6c7790f01b2aeccb5c2b3a
SHA512 fd515309ce48c67a6d3c63083a15d0b03e0f0db2cfe168d5a300111e87e8eaf7eea5f309d59f4d3029055e2eb9d62d26b706cd2536f0be3781558b431c7c4189
SSDEEP 24576:D9bhzjMEvX/sR/PTeq1B4RnNr+lrQ1Q4RAKnC5G3knmOmrbmMlQ8Nu1c:RbhzjMEvX/sR/PTeq1B436lrOQ4RFC5g
TLSH
T195452382259EE427E1DE0BB059A1E17867709E9CDA20CB07FFD87FEFB476B640105242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-102-0x000000000ACC0000-0x000000000ACDF000-memory.dmp

Download

memory/420-101-0x000000000AC90000-0x000000000ACB1000-memory.dmp

Download

memory/420-93-0x000000000A530000-0x000000000A54D000-memory.dmp

Download

memory/420-100-0x000000000A530000-0x000000000A54D000-memory.dmp

Download

memory/2448-165-0x000001EC21750000-0x000001EC217F9000-memory.dmp

Download

memory/2840-442-0x0000000001730000-0x00000000017EF000-memory.dmp

Download

memory/2864-430-0x0000000005FD0000-0x0000000005FE3000-memory.dmp

Download

memory/2864-425-0x0000000007D20000-0x0000000007D31000-memory.dmp

Download

memory/2864-424-0x0000000007A70000-0x0000000007B13000-memory.dmp

Download

memory/2864-416-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/2864-413-0x0000000006120000-0x0000000006474000-memory.dmp

Download

memory/2864-426-0x0000000007D60000-0x0000000007D74000-memory.dmp

Download

memory/2864-429-0x0000000002510000-0x000000000251A000-memory.dmp

Download

memory/2864-415-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/2864-428-0x00000000008C0000-0x00000000008D8000-memory.dmp

Download

memory/4268-140-0x00000000015F0000-0x00000000016AF000-memory.dmp

Download

memory/4268-748-0x00000000015F0000-0x00000000016AF000-memory.dmp

Download

memory/4332-61-0x00000237BE6B0000-0x00000237BE759000-memory.dmp

Download

memory/4332-60-0x00000237BE1B0000-0x00000237BE1BC000-memory.dmp

Download

memory/4332-54-0x00000237BE760000-0x00000237BE782000-memory.dmp

Download

memory/4336-491-0x0000000001000000-0x00000000010BF000-memory.dmp

Download

memory/4336-18-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4336-91-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4336-20-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4336-141-0x0000000001000000-0x00000000010BF000-memory.dmp

Download

memory/4336-90-0x0000000001000000-0x00000000010BF000-memory.dmp

Download

memory/4348-366-0x0000000008520000-0x0000000008534000-memory.dmp

Download

memory/4348-355-0x00000000072A0000-0x00000000072EC000-memory.dmp

Download

memory/4348-370-0x0000000006800000-0x0000000006818000-memory.dmp

Download

memory/4348-369-0x0000000002D60000-0x0000000002D6A000-memory.dmp

Download

memory/4348-368-0x00000000012C0000-0x00000000012D8000-memory.dmp

Download

memory/4348-364-0x0000000008210000-0x00000000082B3000-memory.dmp

Download

memory/4348-346-0x0000000006920000-0x0000000006C74000-memory.dmp

Download

memory/4348-356-0x000000006FC00000-0x000000006FC4C000-memory.dmp

Download

memory/4348-365-0x00000000084E0000-0x00000000084F1000-memory.dmp

Download

memory/5008-24-0x00000000056E0000-0x0000000005767000-memory.dmp

Download

memory/5008-9-0x0000000006DB0000-0x0000000006FC8000-memory.dmp

Download

memory/5008-10-0x00000000056E0000-0x0000000005767000-memory.dmp

Download

memory/5008-7-0x00000000056E0000-0x0000000005767000-memory.dmp

Download

memory/5008-8-0x00000000055D0000-0x00000000055E0000-memory.dmp

Download

memory/5008-1-0x0000000005BF0000-0x0000000006194000-memory.dmp

Download

memory/5008-6-0x0000000006C20000-0x0000000006C32000-memory.dmp

Download

memory/5008-5-0x0000000005950000-0x00000000059EC000-memory.dmp

Download

memory/5008-4-0x0000000005600000-0x000000000560A000-memory.dmp

Download

memory/5008-3-0x00000000055D0000-0x00000000055E0000-memory.dmp

Download

memory/5008-0-0x0000000000AD0000-0x0000000000BFA000-memory.dmp

Download

memory/5008-2-0x0000000005640000-0x00000000056D2000-memory.dmp

Download

memory/5300-332-0x00000000051C0000-0x00000000051CA000-memory.dmp

Download

memory/5300-171-0x00000000051C0000-0x00000000051CA000-memory.dmp

Download

memory/5520-431-0x00000000012A0000-0x000000000135F000-memory.dmp

Download

memory/5792-252-0x0000000005470000-0x000000000547A000-memory.dmp

Download

memory/5792-399-0x0000000005470000-0x000000000547A000-memory.dmp

Download

memory/5804-133-0x0000000007C10000-0x0000000007C24000-memory.dmp

Download

memory/5804-135-0x0000000000AB0000-0x0000000000AC8000-memory.dmp

Download

memory/5804-136-0x00000000057C0000-0x0000000005DC8000-memory.dmp

Download

memory/5804-137-0x0000000005DD0000-0x0000000005DF4000-memory.dmp

Download

memory/5804-138-0x0000000005F10000-0x0000000005F2D000-memory.dmp

Download

memory/5804-132-0x0000000007BE0000-0x0000000007BF1000-memory.dmp

Download

memory/5804-131-0x0000000007930000-0x00000000079D3000-memory.dmp

Download

memory/5804-123-0x0000000070CF0000-0x0000000070D3C000-memory.dmp

Download

memory/5804-122-0x0000000006C70000-0x0000000006CBC000-memory.dmp

Download

memory/5804-119-0x00000000061F0000-0x0000000006544000-memory.dmp

Download

memory/6020-86-0x0000000005D40000-0x0000000006348000-memory.dmp

Download

memory/6020-87-0x0000000005470000-0x0000000005494000-memory.dmp

Download

memory/6020-88-0x00000000063C0000-0x00000000063D3000-memory.dmp

Download

memory/6020-89-0x00000000050C0000-0x00000000050CA000-memory.dmp

Download

memory/6020-85-0x0000000001000000-0x0000000001018000-memory.dmp

Download

memory/6020-81-0x0000000008150000-0x0000000008158000-memory.dmp

Download

memory/6020-80-0x0000000008170000-0x000000000818A000-memory.dmp

Download

memory/6020-79-0x0000000008070000-0x0000000008084000-memory.dmp

Download

memory/6020-78-0x0000000008060000-0x000000000806E000-memory.dmp

Download

memory/6020-77-0x0000000008030000-0x0000000008041000-memory.dmp

Download

memory/6020-76-0x00000000080B0000-0x0000000008146000-memory.dmp

Download

memory/6020-75-0x0000000007EA0000-0x0000000007EAA000-memory.dmp

Download

memory/6020-74-0x0000000007E30000-0x0000000007E4A000-memory.dmp

Download

memory/6020-73-0x0000000008490000-0x0000000008B0A000-memory.dmp

Download

memory/6020-72-0x0000000007D60000-0x0000000007E03000-memory.dmp

Download

memory/6020-62-0x0000000007B20000-0x0000000007B52000-memory.dmp

Download

memory/6020-71-0x00000000070D0000-0x00000000070EE000-memory.dmp

Download

memory/6020-63-0x00000000707D0000-0x000000007081C000-memory.dmp

Download

memory/6020-52-0x0000000007080000-0x00000000070CC000-memory.dmp

Download

memory/6020-50-0x0000000006AF0000-0x0000000006B0E000-memory.dmp

Download

memory/6020-44-0x0000000006500000-0x0000000006854000-memory.dmp

Download

memory/6020-26-0x0000000006380000-0x00000000063A2000-memory.dmp

Download

memory/6020-27-0x0000000006420000-0x0000000006486000-memory.dmp

Download

memory/6020-28-0x0000000006490000-0x00000000064F6000-memory.dmp

Download

memory/6020-21-0x0000000005710000-0x0000000005D38000-memory.dmp

Download

memory/6020-16-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download

memory/6020-17-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download

memory/6020-15-0x00000000012F0000-0x0000000001326000-memory.dmp

Download