9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4

Analysis

user interaction
yes
max time kernel
1050s
max time network
1043s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Reserva.zip
Size 3.8MB
Sample260605-t4vmvsbs41
SHA256 9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4
MD5 ddcb63f893e291fa1437ac3390501182
SHA1 a02d252ec4c775583907e6e1db589bb591463849
SHA512 b151eb173196c0d2b7ef7b920905f44db3e044770b67927eb6eae3d1d7bb61025f146ac0b2587989d90890c2b3909043b424c5b2860a10c6d353ffb221b5567a
SSDEEP 98304:kcE3Vpv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPO6KK:zE3VpjVIxv99rtRfT1JcPB
TLSH
T12516335CC44B3C54DB11F0BB425E89532AC54F87AB562ADF1A769BB1E3C8CB11633C8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
7344	Reserva_Nuvem.exe
5972	Reserva_Nuvem_160.exe
7152	Reserva_Nuvem_160.exe

Loads dropped DLL 18 IoCs

pid	Process
7344	Reserva_Nuvem.exe
7344	Reserva_Nuvem.exe
7344	Reserva_Nuvem.exe
7344	Reserva_Nuvem.exe
7344	Reserva_Nuvem.exe
7344	Reserva_Nuvem.exe
5972	Reserva_Nuvem_160.exe
5972	Reserva_Nuvem_160.exe
5972	Reserva_Nuvem_160.exe
5972	Reserva_Nuvem_160.exe
5972	Reserva_Nuvem_160.exe
5972	Reserva_Nuvem_160.exe
7152	Reserva_Nuvem_160.exe
7152	Reserva_Nuvem_160.exe
7152	Reserva_Nuvem_160.exe
7152	Reserva_Nuvem_160.exe
7152	Reserva_Nuvem_160.exe
7152	Reserva_Nuvem_160.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
584	drive.google.com
591	drive.google.com
783	drive.google.com

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File created	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File created	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\reserva.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gds32.dll	cmd.exe
File opened for modification	C:\Windows\System32\gds32.dll	cmd.exe
File created	C:\Windows\System32\gds32.dll	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\reserva.ini	cmd.exe
File opened for modification	C:\Windows\reserva.ini	cmd.exe
File opened for modification	C:\Windows\reserva.ini	cmd.exe
File opened for modification	C:\Windows\reserva.ini	cmd.exe
File created	C:\Windows\reserva.ini	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
7688	powershell.exe
3680	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6308	powershell.exe
6892	powershell.exe
4840	powershell.exe
7668	powershell.exe
5192	powershell.exe
2116	powershell.exe
6192	powershell.exe
3936	powershell.exe
7648	powershell.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
5016	5152	WerFault.exe	208
7320	7344	WerFault.exe	214
1944	1328	WerFault.exe	239
6820	5972	WerFault.exe	243
6520	7152	WerFault.exe	249
5280	1604	WerFault.exe	268
5896	1160	WerFault.exe	289

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reserva_Nuvem_160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reserva_Nuvem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reserva_Nuvem_160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reserva_Nuvem_160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reserva_Nuvem_160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reserva_Nuvem_160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reserva_Nuvem_160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2408	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
7140	ipconfig.exe
7032	ipconfig.exe
5472	ipconfig.exe
2856	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251511006788355"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
4792	chrome.exe
4792	chrome.exe
6308	powershell.exe
6308	powershell.exe
6308	powershell.exe
5192	powershell.exe
5192	powershell.exe
5192	powershell.exe
6892	powershell.exe
6892	powershell.exe
4840	powershell.exe
4840	powershell.exe
7688	powershell.exe
7688	powershell.exe
2116	powershell.exe
2116	powershell.exe
7668	powershell.exe
7668	powershell.exe
3680	powershell.exe
3680	powershell.exe
6192	powershell.exe
6192	powershell.exe
3936	powershell.exe
3936	powershell.exe
7648	powershell.exe
7648	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5736	chrome.exe
7156	chrome.exe
8188	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe
Token: SeShutdownPrivilege	3884	chrome.exe
Token: SeCreatePagefilePrivilege	3884	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe
3884	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5736	chrome.exe
7156	chrome.exe
8188	chrome.exe
1720	chrome.exe
5788	chrome.exe
7512	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 5008	3884	chrome.exe	106
PID 3884 wrote to memory of 2408	3884	chrome.exe	107
PID 3884 wrote to memory of 5004	3884	chrome.exe	109
PID 3884 wrote to memory of 5004	3884	chrome.exe	109
PID 3884 wrote to memory of 4616	3884	chrome.exe	110
PID 3884 wrote to memory of 4616	3884	chrome.exe	110
PID 3884 wrote to memory of 4420	3884	chrome.exe	111
PID 3884 wrote to memory of 4420	3884	chrome.exe	111
PID 3884 wrote to memory of 3680	3884	chrome.exe	112
PID 3884 wrote to memory of 3680	3884	chrome.exe	112
PID 3884 wrote to memory of 452	3884	chrome.exe	113
PID 3884 wrote to memory of 452	3884	chrome.exe	113
PID 3884 wrote to memory of 3288	3884	chrome.exe	114
PID 3884 wrote to memory of 3288	3884	chrome.exe	114
PID 3884 wrote to memory of 3196	3884	chrome.exe	115
PID 3884 wrote to memory of 3196	3884	chrome.exe	115
PID 3884 wrote to memory of 3724	3884	chrome.exe	119
PID 3884 wrote to memory of 3724	3884	chrome.exe	119
PID 3884 wrote to memory of 2976	3884	chrome.exe	120
PID 3884 wrote to memory of 1880	3884	chrome.exe	121
PID 3884 wrote to memory of 4352	3884	chrome.exe	122
PID 3884 wrote to memory of 1748	3884	chrome.exe	123
PID 3884 wrote to memory of 1748	3884	chrome.exe	123
PID 3884 wrote to memory of 3684	3884	chrome.exe	124
PID 3884 wrote to memory of 3584	3884	chrome.exe	126
PID 3884 wrote to memory of 3584	3884	chrome.exe	126
PID 3884 wrote to memory of 2648	3884	chrome.exe	127
PID 3884 wrote to memory of 2648	3884	chrome.exe	127
PID 3884 wrote to memory of 964	3884	chrome.exe	128
PID 3884 wrote to memory of 964	3884	chrome.exe	128
PID 3884 wrote to memory of 4420	3884	chrome.exe	129
PID 3884 wrote to memory of 4420	3884	chrome.exe	129
PID 3884 wrote to memory of 624	3884	chrome.exe	130
PID 3884 wrote to memory of 624	3884	chrome.exe	130
PID 3884 wrote to memory of 3684	3884	chrome.exe	131
PID 3884 wrote to memory of 3684	3884	chrome.exe	131
PID 3884 wrote to memory of 4712	3884	chrome.exe	132
PID 3884 wrote to memory of 4712	3884	chrome.exe	132
PID 3884 wrote to memory of 2372	3884	chrome.exe	133
PID 3884 wrote to memory of 2372	3884	chrome.exe	133
PID 3884 wrote to memory of 5148	3884	chrome.exe	134
PID 3884 wrote to memory of 5148	3884	chrome.exe	134
PID 3884 wrote to memory of 5260	3884	chrome.exe	135
PID 3884 wrote to memory of 5260	3884	chrome.exe	135
PID 3884 wrote to memory of 5268	3884	chrome.exe	136
PID 3884 wrote to memory of 5268	3884	chrome.exe	136
PID 3884 wrote to memory of 5276	3884	chrome.exe	137
PID 3884 wrote to memory of 5276	3884	chrome.exe	137
PID 3884 wrote to memory of 5284	3884	chrome.exe	138
PID 3884 wrote to memory of 5284	3884	chrome.exe	138
PID 3884 wrote to memory of 5420	3884	chrome.exe	139
PID 3884 wrote to memory of 5420	3884	chrome.exe	139
PID 3884 wrote to memory of 5604	3884	chrome.exe	140
PID 3884 wrote to memory of 5604	3884	chrome.exe	140
PID 3884 wrote to memory of 5612	3884	chrome.exe	141
PID 3884 wrote to memory of 5612	3884	chrome.exe	141
PID 3884 wrote to memory of 5620	3884	chrome.exe	142
PID 3884 wrote to memory of 5620	3884	chrome.exe	142
PID 3884 wrote to memory of 5628	3884	chrome.exe	143
PID 3884 wrote to memory of 5628	3884	chrome.exe	143
PID 3884 wrote to memory of 5880	3884	chrome.exe	144
PID 3884 wrote to memory of 5880	3884	chrome.exe	144
PID 3884 wrote to memory of 5896	3884	chrome.exe	145
PID 3884 wrote to memory of 5896	3884	chrome.exe	145

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Reserva.zip
1⤵
PID:1264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffce3e3c728,0x7ffce3e3c734,0x7ffce3e3c740
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10446914652364614241,9958788939700346984,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,8023449898854305910,9609994717497916659,262144 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2476,i,12957308679796398651,61589110942294410,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,3969704495258751875,17630291854284889928,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,2562353376288269838,8908746844653233606,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,3077229316655845177,8571097938341993903,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4576,i,2290629789864376910,5779428613643389543,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,9013414486995345010,8597312644909530974,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3564,i,3526461186011657801,2149052426500623282,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,16180264577798736210,13228973381306459957,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5136,i,11879778631682688833,4383532661645850175,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5124,i,17721075650312947237,9091630411084340678,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4836,i,2166406059883428830,3693641607536377726,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,6397741822666577210,8545677507039715654,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5904,i,13269679479624302565,3209868768868729046,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5600,i,10394520613390425691,290736927578797112,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6076,i,4198828680127507235,1689551412728100745,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6136,i,8925902708922747639,17458335367225596413,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4696,i,187007985067857552,11034108319574353624,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5708,i,15632428900274022260,14060325542375569464,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6300,i,18263614374083489244,4316154955037447446,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6524,i,8843210179716736550,9188080436193989036,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6644,i,8647346746093318380,5195950055338333272,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7080,i,16816812400170352623,1339604709701556013,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6952,i,5734672142605362653,11059694756533311691,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7248,i,11957406336937254903,6811400213414755427,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7188,i,13184342495885739363,18396505259694100042,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7324 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7472,i,14146809079311410586,4062919549161224424,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7688,i,4460133954523690486,6382253700180127288,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7812,i,12688697660056252751,4024128192655146057,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7956,i,5548125266227990577,3003633957442928291,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8092,i,12693714526853580243,2165958332215533123,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8108 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7164,i,8131822175031370279,13993102950184916569,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8344,i,5899422734119400032,8619442456690458916,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8340 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8508,i,13005702968680113596,18383505539255067385,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=8604,i,3932623256146150068,1842215182193549262,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8616 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8748,i,8201682531129925474,9724619580734467474,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8760 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=8892,i,12597336322432835491,13684741789027933767,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8904 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=9024,i,962411017312965223,13122877320332536264,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9056 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=8360,i,9121509512886872341,5569337635482146397,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8424,i,3851101345039939080,10730967129625024647,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9292 /prefetch:1
  2⤵
  PID:6200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8388,i,13512795646451977414,11723615501592752223,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9460 /prefetch:1
  2⤵
  PID:6208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=9584,i,4328943140247190190,9511108599181325407,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=9664,i,10874003660192370585,13333577773877577036,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9648 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=9692,i,5940608638431461821,17478985778885835314,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9176 /prefetch:1
  2⤵
  PID:6320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=9704,i,13495452439849552526,407105383614862695,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9776 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=9816,i,11941078652534385431,5798141611254800060,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10116 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=10124,i,6328316216270619236,1330693850486107575,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10244 /prefetch:1
  2⤵
  PID:6344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=10384,i,2777778390463756046,15308966701868227815,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10392 /prefetch:1
  2⤵
  PID:6352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=9660,i,8829801806276821758,17608212824476138578,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10936 /prefetch:8
  2⤵
  PID:6708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=11192,i,10910870349216333748,5640535895949899858,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11188 /prefetch:1
  2⤵
  PID:6748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=11328,i,13537237037396150074,14712646258050324742,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11344 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=11472,i,9923997505832928046,13471511076261556793,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11484 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=11616,i,7817545579377420577,9918701457851123537,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11632 /prefetch:1
  2⤵
  PID:6772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=11760,i,12356550005914970778,13570306680568837886,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11768 /prefetch:1
  2⤵
  PID:6780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=11904,i,15585413429988687885,14227563860636877447,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11940 /prefetch:1
  2⤵
  PID:6788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=11920,i,3583124027966474791,17637540580197837827,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12056 /prefetch:1
  2⤵
  PID:6796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=12504,i,16381888453600394425,14164309483326650610,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12516 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=12652,i,5867154521326709102,18441097156182101712,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12656 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=12808,i,8937318094840019759,15655722131134102146,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12784 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=12944,i,9378059780457489602,13319451342128219551,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12948 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=13080,i,8592476772296728438,15314615962344536581,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13096 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=13224,i,13323500374953306325,8135655083725216554,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13236 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=13376,i,14709781768024893160,10915705999247669165,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13372 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=13516,i,10810164825787764051,6716653561800702312,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13520 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=13904,i,5075071211672570039,4451007243059354404,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13896 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=12524,i,10941654269702563621,18265849253010647907,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11320 /prefetch:1
  2⤵
  PID:7392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=14652,i,175274807672850676,15730458662339287930,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10672 /prefetch:1
  2⤵
  PID:7400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=14792,i,4679807068765067300,17821375211360110574,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=14788 /prefetch:1
  2⤵
  PID:7408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=12356,i,2352879529007388712,11809222034969331376,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=12320 /prefetch:1
  2⤵
  PID:7664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=12348,i,11401254032662146134,1995678458338701480,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=13504 /prefetch:1
  2⤵
  PID:7672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=11508,i,2107441582054252398,15875281030967482945,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15248 /prefetch:1
  2⤵
  PID:7752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=7508,i,2335682702611148341,10265383798544010624,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:6700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=15344,i,8307043247328441646,5712220239172181840,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15240 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1132,i,6034640312822483520,14128029687396141102,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15300 /prefetch:8
  2⤵
  PID:6812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=15304,i,3289547144607475758,183277588267842164,262144 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,11387095346705885811,3627695234913104080,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15260 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:7156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=15260,i,5822043816107554698,4071218949281856004,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=15308 /prefetch:8
  2⤵
  PID:6324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=8544,i,2648707222307661989,4900919496100753364,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8468 /prefetch:8
  2⤵
  PID:7384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=8000,i,14001974273336844933,1443549941995028177,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=11508 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9000,i,4190775351335946983,18375652768243290445,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:8188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8024,i,4575020923835294452,234531315436229343,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9012 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=7028,i,8760908326414760425,8919241587939095599,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8556 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,17443824095167203546,8513326121700500269,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7340 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7340,i,17150327626048323664,16369456687886914498,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7192 /prefetch:8
  2⤵
  PID:6872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9000,i,16063134064162581405,6661242452708153027,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=7060,i,17717581636757089426,13894601066543946788,2097152 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6508,i,4894510548345556630,14104298075225712487,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7440 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:7512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7028,i,10117561057429492518,1872057093607427563,524288 --field-trial-handle=2012,i,8873726986654807126,15789016391005774518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:6964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Reserva\Instalar_Cliente.cmd"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
PID:7144
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:6536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6220
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:6200
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:7140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5192

C:\Users\Admin\Downloads\Reserva\Reserva_Nuvem_160.exe
"C:\Users\Admin\Downloads\Reserva\Reserva_Nuvem_160.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 876
  2⤵
  - Program crash
  PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5152 -ip 5152
1⤵
PID:3000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd" "
1⤵
PID:7448
- C:\Reserva_Nuvem\Reserva_Nuvem.exe
  "C:\Reserva_Nuvem\Reserva_Nuvem.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 896
    3⤵
    - Program crash
    PID:7320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7344 -ip 7344
1⤵
PID:7336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Reserva\Instalar_Cliente.cmd"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:6264
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:6924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6948
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:7048
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:7032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4840

C:\Users\Admin\Downloads\Reserva\Reserva_Nuvem_160.exe
"C:\Users\Admin\Downloads\Reserva\Reserva_Nuvem_160.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 852
  2⤵
  - Program crash
  PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1328 -ip 1328
1⤵
PID:7948

C:\Reserva_Nuvem\Reserva_Nuvem_160.exe
"C:\Reserva_Nuvem\Reserva_Nuvem_160.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 876
  2⤵
  - Program crash
  PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5972 -ip 5972
1⤵
PID:6936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd" "
1⤵
PID:6388
- C:\Reserva_Nuvem\Reserva_Nuvem_160.exe
  "C:\Reserva_Nuvem\Reserva_Nuvem_160.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 860
    3⤵
    - Program crash
    PID:6520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7152 -ip 7152
1⤵
PID:6532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Reserva\Instalar_Cliente.cmd"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:4000
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:7404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:7296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ChildItem 'C:\Reserva_Nuvem' -File | Unblock-File -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:7688
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:1844
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:5472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Reserva\Abrir_Reserva_Nuvem.cmd"
1⤵
PID:5432
- C:\Users\Admin\Downloads\Reserva\Reserva_Nuvem_160.exe
  "C:\Users\Admin\Downloads\Reserva\Reserva_Nuvem_160.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 872
    3⤵
    - Program crash
    PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1604 -ip 1604
1⤵
PID:4668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\reserva\Instalar_Cliente.cmd"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:8052
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:8168
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:8164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ChildItem 'C:\Reserva_Nuvem' -File | Unblock-File -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Windows\system32\findstr.exe
  findstr /i /r "\<firebird\>" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:5320
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut([Environment]::GetFolderPath('Desktop') + '\Reserva Nuvem Seguro.lnk'); $s.TargetPath='C:\Reserva_Nuvem\Abrir_Reserva_Nuvem.cmd'; $s.WorkingDirectory='C:\Reserva_Nuvem'; $s.IconLocation='C:\Reserva_Nuvem\Reserva_Nuvem_160.exe,0'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\reserva\Abrir_Reserva_Nuvem.cmd"
1⤵
PID:4792
- C:\Users\Admin\Downloads\reserva\Reserva_Nuvem_160.exe
  "C:\Users\Admin\Downloads\reserva\Reserva_Nuvem_160.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 876
    3⤵
    - Program crash
    PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1160 -ip 1160
1⤵
PID:4004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\reserva\Verificar_GDS32.cmd"
1⤵
PID:2444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\verificar_gds32_2897.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:7648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0jyg5c4p\0jyg5c4p.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDEBA.tmp" "c:\Users\Admin\AppData\Local\Temp\0jyg5c4p\CSCD49DB90931FF43EB8CC0218A5F46986D.TMP"
      4⤵
      PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Reserva_Nuvem_160.exe

Path C:\Reserva_Nuvem\Reserva_Nuvem_160.exe
Size 16.7MB
SHA256 3ab54134459ab0cd4c61c5d3c3bfd71949310d5ac9cdb20532e5648bf9247f50
MD5 096645bb6c298a126a963f84b5e99237
SHA1 db285b0b0c0aeea4810a1be70e3caf5ec6b4d423
SHA512 450cac35c8359f00974e0704ab89159e15ec65744906a4bff065b691bb536f8a65924e94a171834ae0fd90d4cfb6ac9aaffc47da59f0ab458aa1a02d084252ac
SSDEEP 393216:x3QEYqNTD1QoNFFx5CAuK3m25kyORkXAwbmMnXBFuR:2E/4R
TLSH
T1320739163F49D813C06A4E74CE0BC6FC5666BE10FD6045ABF7E03F4EF675640A82A296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbexpint.dll

Path C:\Reserva_Nuvem\dbexpint.dll
Size 120KB
SHA256 603a15f62647bb39e8bab3508f2a3fef25417185c4fc1281001cfb4f0a3ff5e8
MD5 d32d73583ec44fbabbce9466ab3dbbca
SHA1 17c8945b8499375c9e77cb18c025b851d3987753
SHA512 6176a51183af0e7f8b1e8bce25d6b190b8ca3731ed58fe317ca8461d4eff973436557fdb7f7c0f2903ed53b1507885157388bbcde327b3a3b6c1e2b23c3fe2aa
SSDEEP 3072:hqJFfEx0HmP3Ix/YBQCYmiWplq/o02mkM7N5buR:hZIpYBjYmix/UmTN5
TLSH
T1FBC37C12FAC0C178E55141724D783776667EFE860B1A63EB23C9B8B91DF1260BF06297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

midas.dll

Path C:\Reserva_Nuvem\midas.dll
Size 289KB
SHA256 0b0edf7067ecb7a9554ffe5743fb65ba6e25c6407c137cb3657f7b8dd046138e
MD5 a82285dda6f4778e5504fdf463f263e8
SHA1 7d49097c362234e0bd991a8ab216733e98c70414
SHA512 fcd6fa22906974ba0c87ae1dc8a04f29fa96cd8fd61d8d65029305c654dbbd67d553b0dca73bbaa816ca2bd36dec607d9a8f60f8c7aaae29fdac2a10f4fdd77f
SSDEEP 6144:BeIZ5FcoGNQM4+hmwRtheDV2dyYjD9hYkn95myuj:BeKcofM4kAEx2
TLSH
T137546D11FC90C271C05101F05D39FB31797EAE656B2DA2873399B9AC9FB2360AB4275B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
MD5 9e8a968ddefd4d013e51d21d82cf1104
SHA1 2fbcd2f941dcb366be77993bac70c4e59d25de29
SHA512 5c8f8e39a186c5f1aa266b589b30bd1126d6f7e74860b3db3e5e427f28c5b8e9beec691dfaed35f96d0998833be844518bee7e0a64b8ccb4dde37e161d1c26c8
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 615815ed3f9af79624f5116701777e4b1711bb814e754f6ba2a12b3f9531dcbf
MD5 c6cdb9ed7bb2dcb1bbd967111be173e7
SHA1 37e4c4fd28b5da7139303000694651e8a8b417b6
SHA512 80f32ee653dd0165b8a9b49b3ee82167b35e0a82c5fb0d738d2fe25726fde682797fba1c80ca5a78747de33fc9ab4e5d635612df2c48ff70baedd4ecdf8803d5
TLSH
T151F0F9B6D931AC7718FD172830A50B4BE75013572B80999F3A3C810D8FB5B3B454591C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9aafc8481a7258df2800b17768af2c984b48e6e78936b0e8be4716be893e979d
MD5 6e6555ac4936c8e1ae97ec62dac6055a
SHA1 5f02ad58c185bf97b6fba8f235aa0d4398fa3ad1
SHA512 f6824006a8c42444cf5f349a2170a62d35f066e087e07f5fccf4ddfacf87f6b25cbb7b9c4ff15bd976a558707d15540e75531efa795b68ae790da35bfe15ba94
TLSH
T103517BB7D7D8866DC41552E4AB25AE2FCE3D0E19131D3C2688D8AF4B53E2873D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fde9f948e296fdab1a0902479a4b87f6722336b3724f872c9c8fe27e1fc98a60
MD5 7511a64a17b6ea4cf5130f447f3548d0
SHA1 5999d772fd78e2c444aa0155663a9145bf991544
SHA512 d4f82850f6f593c7e5e0ebcc483c0b537bd7e8a3a4d29a2aa44e3917bcb13f53cb05c880ef78df5a9e50dc0cec55b89b9b36826eadaf6edf5305d42b642cb4c3
TLSH
T1F251ADF797E4866DC51052E4EB116E2FDD3D0A14032C3C6688D4AE5B93E2973D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 29a4552ce5955d4fa3d3212d57ee64e2f20df4ebb6bbda6b4ff1f84f33ec6a3a
MD5 e0028fda454844fe300e7e51e7ecad77
SHA1 b3458a31022659350cfa0cd11c32776b804c3b62
SHA512 c4fce10fc96919509d5988233cd754c5d82e0862e2818a4185b0f4ded604e5ac070df430b6ca393c3865c2c82fb2540741a9de51e8b3f7ae308991cc54129c84
TLSH
T10D51ADF797E4866DC51152E4EB21AE2FDD3D0A24032C3C6688D4AE5B93E2873D21079E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 efa1ac15bb0d0454a04359b96d3247cfbe70a5b6d471bd12ebfa6983d188efbe
MD5 a5ec0932d51dff4eed816096e9bf03aa
SHA1 0cca6dff6bb84f7af99d74b60b01d89f937b8d61
SHA512 7afde06280945ba49c6d75c8539a236be6bf41e9cf79ccbfa3357d63dd786cea3684a9b8d3c2a77c674fcc719f6c16fe3839d37d0b101121ce76daea2a0ad1aa
TLSH
T15EF09EABB27E743721BD85EF1D49BC4969F5BC31258A68F0CEAA816DE0854F31F02443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 53c38d1a960bbd3236c0d75c71736360ddcfb795a18f5973b3863d83c027336c
MD5 2fd7b5175baa1d0958bbaad8ee1945cb
SHA1 79105579b80e470254b5de8ed0953292e7d7430d
SHA512 28b31f1d0c0b60d65867cd275df6bbff3dc7a9269e45cf939752a938d08e3cb92b8879d1854cfd79fbebf3cfd842251a7dfe0041f277d2e2086368e0ce3e7f24
SSDEEP 192:8Ro0xOfv78p/PRpX09DHsb+WNnj406ZX2v0kwLPyIsnAUgraJ:8Ro0Q34hXE5ws06B2cfe
TLSH
T1E752B72EFD10697B6CDBD229F9657B53D3F6202261911E84EAFC8A1C14E76CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b6661739d791e9f515924eeaadf896189a032a621b0d806c5000d25b0bbf312f
MD5 12a6b2a75bc69ad57412332c57fcb41c
SHA1 b94bd6c6d97a21da63dc5b2a29a2c0f69c48b134
SHA512 d7fde087205de945497c2847d88cc98a304528d0f82858d0e7543db964e3b79167c332b3650eadb88881cb51365a7562b8740976c2fb84f5973a304be9971ed3
SSDEEP 192:8Ro0xOdv78pAPRp209DHsb+WNnj400aX2v0kw9PyIsnAUgraJ:8Ro0Qd4UXD5ws00s2cpe
TLSH
T1FB42B62EED10693B6CDBD219FE657B53D3F6102261952E84EAFC8A2C14E75CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4b36d0d6eac6d919f72dc47a529783490d711634023257f07c9f7bcaba493304
MD5 c83dd09a482dfc72ec0b1b65ddb7a68a
SHA1 50e80ac6605b3d9cb7349976a88d940234fdf840
SHA512 d5f418ee4081ab68aa8100a15a034cadad92e8e8cf90a76dd575892df83d3e48cc5d5ea7cf69cd89349bdbfe4656e0667c5e268c0a2b6bf82a8744fc447f65ce
SSDEEP 192:8Ro0xOGv78pAPRp209DHsb+WNnj40XaX2v0kwEPyIsnAUge:8Ro0Qy4UXD5ws0Xs2c2e
TLSH
T15B42A52EAD10693B6CDBD229FD657B53D7F6102261911E84EAFC8A2C14E75CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 207933501d33c849342e6b124d908363845e6b1fcc0e9f71a75643c8a7c4acc0
MD5 ce4751c9ad275d67410aa2985cb94fd6
SHA1 8a62a6cfe2b0c7a907e714fe09ab075c515a10b3
SHA512 b1e1ba5bd133e541c3ced2e9400d80104ca7a79530919efbb285d79006602011b9591ccbd5d5cf4fd598b7fa08006b0ab9f5a2e53de92a3101ae6485592ee4a8
SSDEEP 192:8Ro0TOfv78p/PRpX09DHsb+WNnj406ZX2v0kwLPyIsnAUgraJ:8Ro0S34hXE5ws06B2cfe
TLSH
T1BA52B71EFD10697B6CDBD219F9657B53D3F6202261911E84EAFC8A1C14E76CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0ab8c4687d27f0e71a8e87c63b33148e717e4066c9b9e838c75a8d083e504eea
MD5 f9f50726fbef8fe03ea0b2da81d7e060
SHA1 2f7cf88cade4bedbcbfdf0653fa2ac5bb5b7735c
SHA512 21a0bf2457d92237a2701f2c823a048ad317753175683ebb767b1ebf39e97e2eb045753224adbb3ff4244fb84ad8c08ccc7a7a7914e68ba9fad46a51de8851f8
SSDEEP 192:8Ro0TO2v78p/PRpX09DH2JDHsb+WNnj406ZX2v0kwLPyIsnAUgraJ:8Ro0SC4hXEmrws06B2cfe
TLSH
T1F752C61FED10697B6CDBD219F9617B57D3F6102261912E88EAFC8A1C14E76CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fac5bb76b909b70d1cada5b28a711a6452536cc067f1cbe3fffb8b06ea6b4a7d
MD5 f02678cc7d3c71b9cf50196656f411ae
SHA1 a877ebb525906a1b75c3424881c45b22c195225b
SHA512 88d3bcfcba2378f10b4e0c0a8609cc56b0badc597b718c61490fbfc3bee8a26b30252c52ac2b15f8f6197b84984caa94d8aa606320237e9c268095b6e2adee20
SSDEEP 3072:5eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMr:55m7Rkm1tYpBeh2BAor
TLSH
T186C3123BAD75E83759B9BB1AB04E0B1F1EF14DA7C920DE52C8D85B0423E97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1e6e287acc3824621d2e215fe7df9bcb60f9c4666718994216b25268db0c66c6
MD5 e9322e509c2e0e86949c3ddc261e6634
SHA1 209f2747a1b519e11244867b5a96fc0b23bce952
SHA512 99852900490b6e0e8a7a852187efcd3f49f8dc963009124a9fbf9fac93db3a8f926904b68d0cffea16d0b49539eaae443873a9d1be7fe401549d5db614cae7a2
SSDEEP 6144:z1qx2gEAQo9Gr238YoW8nj+fS+Cm7Rkm1tYpBeh2BAo4:hqx2gEA60GVn8SM9oBGcAo4
TLSH
T11134123BED62BD768C7D6B0F544B271E2EF16A73D114DA8ED8D027003A6E9982E05931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1499dc7bf96096a59ea114d1d551ef57d245e14d4d5bdbbb23ff76c199aac58d
MD5 d93daf2829d4598544652fa48b5c11fa
SHA1 9dbbbf64b67f18fea3c7f8299a51664c209d446a
SHA512 db6fa3317dfc83d5351a52a6d1453c3b58b290472ca2670471b0bbccf1ed3dd5cbd10ec64fe31a2d3fe916c4b40b02d967217328e3b3ca069962e402a36723c1
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:/m7Rkm1tYpBeh2BAoO
TLSH
T138C3123B5D65E9375979A70EB48E0B1E1EF249A6C930DE4288D86B0437FA7CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 d483c6cc772b287e082e28f9a86797bc33cd63dcbc1763ebac90afc6dec9694e
MD5 f1e7c311b823eb7f5bc5132bf8e0ca20
SHA1 bb4e72d8cbb9c4e6d7bf13feec02ce854c94c1e1
SHA512 6feea42e3203757ea2a2c34a0ce6c3d917504c71df4a26bda044d181272be0a21cd93406e87baa722320a5dc37b6a1a7a43dc66aaae68269427c7e9519d2f3c6
SSDEEP 6144:Yfx2gEAQo9Gr238YoW8nj+fS+Cm7Rkm1tYpBeh2BAo4:Yfx2gEA60GVn8SM9oBGcAo4
TLSH
T1D934233BEEA2BD779C7D6B0F544B170F26B16C73A114DA8EC9D067043A7D9C82A05931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 273KB
SHA256 4ae5f0fd9d0c8e15976cb0ddfb175921e2981893314b62de0219d367b03f5265
MD5 abac446d033f9c4331af095d6159ac3e
SHA1 e998df93b1993cec1d90eba61f2e670da26f1a38
SHA512 1436c0bb17ea9a11814d8f6acb9e72235c8f70e29c78218d1e2ee8879b529b3e1dc70fe7e5fdb4b0a2d50d5ca747d13651aeabc8f811bf970b830a8bf358f7ab
SSDEEP 6144:cD3rM51ux2gEAQo9Gr238YoW8nj+fS+Cm7Rkm1tYpBeh2BAo4:cD3Qjux2gEA60GVn8SM9oBGcAo4
TLSH
T1CC54233BEE623C769D7C634FA047371E1EF0AE67E014D98EE9C0360036AE9982D59571
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1b22129db13f11cd3ba6b52555f627044d7d52ee43648305438b146b925eb8d3
MD5 ad8735f307bdfb68e9b2588023360e80
SHA1 b8c7cdbe99d492b4547a3833ce81951d86f01ca5
SHA512 ef847e4d7670f80eef188d89f6392b579b37a6ec23f177b14ab9b248abeb8d4adbd7c7ad573438b3a1d18e17430a587c73690e6377415749e525b198d98998bc
SSDEEP 6144:v1qx2gEAQo9Gr238YoW8nj+fS+Cm7Rkm1tYpBeh2BAo4:9qx2gEA60GVn8SM9oBGcAo4
TLSH
T11B34123BED62BD768C7D6B0F544B271E2EF16A73D114DA8ED8D037003A6E9982E05931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sayndaak.hln.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sayndaak.hln.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Reserva.zip.crdownload

Path C:\Users\Admin\Downloads\Reserva.zip.crdownload
Size 3.8MB
SHA256 9ebbfb0305d0850624c4c0569867b12f0147c0a832218b6574984d977d73b3d4
MD5 ddcb63f893e291fa1437ac3390501182
SHA1 a02d252ec4c775583907e6e1db589bb591463849
SHA512 b151eb173196c0d2b7ef7b920905f44db3e044770b67927eb6eae3d1d7bb61025f146ac0b2587989d90890c2b3909043b424c5b2860a10c6d353ffb221b5567a
SSDEEP 98304:kcE3Vpv7ZlAwIxoSj9CY9+K6xqtRfTU0iOHpIzPO6KK:zE3VpjVIxv99rtRfT1JcPB
TLSH
T12516335CC44B3C54DB11F0BB425E89532AC54F87AB562ADF1A769BB1E3C8CB11633C8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gds32.dll

Path C:\Windows\System32\gds32.dll
Size 380KB
SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
MD5 1abd772ece0cc871696a867d1f2076d8
SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
TLSH
T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reserva.ini

Path C:\Windows\reserva.ini
Size 498B
SHA256 24a51aab453ffd1f9b8aa339a09e5782a67ba2cc084e9c926c0edabba04b6e75
MD5 7f26e0cf391fde7c777b39c6f9238e99
SHA1 eee2368387a9bb0b0382745b7e0b7a9c2de91796
SHA512 1ec7880d70ff898a57a877bf7901f297ae0912394fc9ee3f42641a76af0179649bdd7f6e5608e0a4285816d1cf424a812a091d2ac195c62ca37bc9b1ca984221
TLSH
T1C2F0E090D843A0410F07B56706243799634B158EF4F6021195D59C2B9E4E5015BD7FD3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1160-439-0x0000000005A40000-0x0000000005A67000-memory.dmp

Download

memory/1160-438-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/1328-288-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/1328-289-0x00000000034A0000-0x00000000034C7000-memory.dmp

Download

memory/1328-272-0x00000000034A0000-0x00000000034C7000-memory.dmp

Download

memory/1328-267-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/1328-268-0x00000000034A0000-0x00000000034C7000-memory.dmp

Download

memory/1328-265-0x0000000005C70000-0x0000000005CD5000-memory.dmp

Download

memory/1328-262-0x00000000034A0000-0x00000000034C7000-memory.dmp

Download

memory/1604-369-0x00000000031B0000-0x00000000031D7000-memory.dmp

Download

memory/1604-363-0x00000000031B0000-0x00000000031D7000-memory.dmp

Download

memory/1604-364-0x0000000005AA0000-0x0000000005B05000-memory.dmp

Download

memory/1604-366-0x0000000005CA0000-0x0000000005D05000-memory.dmp

Download

memory/1604-368-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/3680-402-0x000001CA34060000-0x000001CA341AE000-memory.dmp

Download

memory/3936-432-0x00000212ABAF0000-0x00000212ABC3E000-memory.dmp

Download

memory/5152-166-0x0000000003470000-0x0000000003497000-memory.dmp

Download

memory/5152-187-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/5152-188-0x0000000003470000-0x0000000003497000-memory.dmp

Download

memory/5152-186-0x0000000003470000-0x0000000003497000-memory.dmp

Download

memory/5152-168-0x0000000005BF0000-0x0000000005C55000-memory.dmp

Download

memory/5152-183-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/5152-178-0x0000000003470000-0x0000000003497000-memory.dmp

Download

memory/5152-177-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/5152-181-0x0000000003C00000-0x0000000003C65000-memory.dmp

Download

memory/5192-165-0x0000028AFC2C0000-0x0000028AFC40E000-memory.dmp

Download

memory/5972-296-0x0000000005A50000-0x0000000005A77000-memory.dmp

Download

memory/5972-293-0x0000000005D10000-0x0000000005D75000-memory.dmp

Download

memory/5972-291-0x0000000005A80000-0x0000000005AE5000-memory.dmp

Download

memory/5972-290-0x0000000005A50000-0x0000000005A77000-memory.dmp

Download

memory/5972-295-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/6192-422-0x000002445B240000-0x000002445B38E000-memory.dmp

Download

memory/6308-149-0x000002527F100000-0x000002527F122000-memory.dmp

Download

memory/7152-298-0x0000000005AB0000-0x0000000005B15000-memory.dmp

Download

memory/7152-300-0x0000000003400000-0x0000000003465000-memory.dmp

Download

memory/7152-303-0x00000000034A0000-0x00000000034C7000-memory.dmp

Download

memory/7152-302-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/7344-194-0x0000000000400000-0x00000000014B1000-memory.dmp

Download

memory/7344-189-0x0000000005A40000-0x0000000005A67000-memory.dmp

Download

memory/7344-190-0x0000000005A70000-0x0000000005AD5000-memory.dmp

Download

memory/7344-192-0x00000000051A0000-0x0000000005205000-memory.dmp

Download

memory/7344-195-0x0000000005A40000-0x0000000005A67000-memory.dmp

Download

memory/7648-456-0x0000000005500000-0x0000000005B28000-memory.dmp

Download

memory/7648-469-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/7648-457-0x00000000053C0000-0x00000000053E2000-memory.dmp

Download

memory/7648-458-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Download

memory/7648-459-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/7648-465-0x0000000005D80000-0x00000000060D4000-memory.dmp

Download

memory/7648-468-0x00000000063A0000-0x00000000063BE000-memory.dmp

Download

memory/7648-455-0x0000000002DB0000-0x0000000002DE6000-memory.dmp

Download

memory/7648-470-0x0000000007CE0000-0x000000000835A000-memory.dmp

Download

memory/7648-471-0x00000000068C0000-0x00000000068DA000-memory.dmp

Download

memory/7648-479-0x0000000006930000-0x0000000006938000-memory.dmp

Download

memory/7648-480-0x0000000007660000-0x00000000076F6000-memory.dmp

Download

memory/7648-481-0x0000000007560000-0x0000000007582000-memory.dmp

Download

memory/7648-482-0x0000000008360000-0x0000000008904000-memory.dmp

Download