guloader | 2f423571a318924318504db10008bc4cc48afd550c59caf89b40a04c94a890f7

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rpayment.scr.exe
Size

701KB
MD5

e7bbeae6c391accd957b6475dd5f0e63
SHA1

9460741f8eaff856a8163ad5a22c68dd24a0595e
SHA256

2f423571a318924318504db10008bc4cc48afd550c59caf89b40a04c94a890f7
SHA512

83feec2439997a2b9f7a2ae67966d7ab831d8eb9d8d8836746223b05c73e45e48cce3fc5d6ba420907e3c279ae2916d734b366829404786936cb93bc567f18d8
SSDEEP

12288:LR3BUIa3RVtFRe5L7lwvIuBUz3D46l0xFXc3gIwEL:V3GIQHY5vlI7Mnl0Pg73L

Score

10^/10

guloader remcos host-2 collection credential_access discovery downloader rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

Host-2

176.65.142.14:6060

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HM3EZ8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2780-80-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft
behavioral2/memory/2780-81-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft
behavioral2/memory/4396-93-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/5984-106-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5984-106-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2780-80-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView
behavioral2/memory/2780-81-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 15 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4352	Chrome.exe
3788	Chrome.exe
4444	Chrome.exe
5556	Chrome.exe
412	Chrome.exe
1020	Chrome.exe
5552	msedge.exe
1908	msedge.exe
2248	Chrome.exe
4956	Chrome.exe
6100	Chrome.exe
4428	msedge.exe
5392	Chrome.exe
3292	Chrome.exe
2976	Chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
5724	rpayment.scr.exe
5724	rpayment.scr.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	drive.google.com
28	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2060	rpayment.scr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5724	rpayment.scr.exe
2060	rpayment.scr.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 2780	2060	rpayment.scr.exe	108
PID 2060 set thread context of 5984	2060	rpayment.scr.exe	110
PID 2060 set thread context of 4396	2060	rpayment.scr.exe	113

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ar\messages.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Common Files\crepe\satanerne.ini	rpayment.scr.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\my\messages.json	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpayment.scr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpayment.scr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876062445957209"	Chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{39A8ABCA-AF22-4063-B21D-08EECFBC074F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2060	rpayment.scr.exe
2060	rpayment.scr.exe
2780	recover.exe
2780	recover.exe
4396	recover.exe
4396	recover.exe
5392	Chrome.exe
5392	Chrome.exe
5392	Chrome.exe
2780	recover.exe
2780	recover.exe
2060	rpayment.scr.exe
2060	rpayment.scr.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5724	rpayment.scr.exe
2060	rpayment.scr.exe
2060	rpayment.scr.exe
2060	rpayment.scr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	recover.exe
Token: SeShutdownPrivilege	5392	Chrome.exe
Token: SeCreatePagefilePrivilege	5392	Chrome.exe
Token: SeShutdownPrivilege	5392	Chrome.exe
Token: SeCreatePagefilePrivilege	5392	Chrome.exe
Token: SeShutdownPrivilege	5392	Chrome.exe
Token: SeCreatePagefilePrivilege	5392	Chrome.exe
Token: SeShutdownPrivilege	5392	Chrome.exe
Token: SeCreatePagefilePrivilege	5392	Chrome.exe
Token: SeShutdownPrivilege	5392	Chrome.exe
Token: SeCreatePagefilePrivilege	5392	Chrome.exe
Token: SeShutdownPrivilege	5392	Chrome.exe
Token: SeCreatePagefilePrivilege	5392	Chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2060	rpayment.scr.exe
5392	Chrome.exe
5392	Chrome.exe
5552	msedge.exe
5552	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2060	rpayment.scr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 2060	5724	rpayment.scr.exe	90
PID 5724 wrote to memory of 2060	5724	rpayment.scr.exe	90
PID 5724 wrote to memory of 2060	5724	rpayment.scr.exe	90
PID 5724 wrote to memory of 2060	5724	rpayment.scr.exe	90
PID 5392 wrote to memory of 4132	5392	Chrome.exe	104
PID 5392 wrote to memory of 4132	5392	Chrome.exe	104
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 4664	5392	Chrome.exe	106
PID 5392 wrote to memory of 4664	5392	Chrome.exe	106
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 5692	5392	Chrome.exe	105
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107
PID 5392 wrote to memory of 1048	5392	Chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\rpayment.scr.exe
"C:\Users\Admin\AppData\Local\Temp\rpayment.scr.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Users\Admin\AppData\Local\Temp\rpayment.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\rpayment.scr.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2060
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff91d37dcf8,0x7ff91d37dd04,0x7ff91d37dd10
      4⤵
      PID:4132
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2020,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2012 /prefetch:2
      4⤵
      PID:5692
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --field-trial-handle=2132,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      PID:4664
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --field-trial-handle=2264,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2260 /prefetch:8
      4⤵
      PID:1048
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3312,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2248
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3336,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4352
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4796,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4792 /prefetch:8
      4⤵
      PID:2744
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4964,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4960 /prefetch:8
      4⤵
      PID:1908
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5056,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3292
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5080,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3788
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5508,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5380 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6100
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5316,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4444
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5048,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5440 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4956
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4836,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5720 /prefetch:8
      4⤵
      PID:5588
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5728,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5556
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5696,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3328 /prefetch:8
      4⤵
      PID:5664
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5440,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5276 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:412
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=3308,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3304 /prefetch:8
      4⤵
      PID:2484
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3716,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2976
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5740,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4892 /prefetch:8
      4⤵
      PID:1100
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5136,i,8040235734115904239,4972931364856078872,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5192 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1020
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\xrfofoorukiokfvyycyop"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2780
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\huszggztqsatmtjchnkqakkj"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:5984
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\koyrgykmeasgxzfgyyxjdpfsjzc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ff90cfff208,0x7ff90cfff214,0x7ff90cfff220
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2040,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2156,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:3
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2704,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3572,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4440,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4784,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4760,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4864,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5596,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5596,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5652,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5828,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6064,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5768,i,4804531799127874086,13977313025680336209,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
      4⤵
      PID:3948

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5552_315657403\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
4e1dce855eee735529b8306709778230

SHA1
04a2b07f8449c07c6ab91b8be23b6ad21861c3ad

SHA256
402de49b0ddf1ade8edb3905c11c8a55071d2d1a9f2417e286446687312a8035

SHA512
5725631f29c26de162a883a248638a36e00a19641c97829c82b506631bf18be0899782207cf4f7df6a25c1fe7f2fa47527947c9bc45f2d38ff34cbd6d8e83465

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
b0366599d64b0fc1adb2a712dcd02ee1

SHA1
b7a1c09ccd2846664cab5f76bd80b8e9f107acb0

SHA256
ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189

SHA512
d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
e458ce7664b7b504053412a5c7f9e8fe

SHA1
090157f9086cf6c6d5d9e0ef4e3824cb9447fecc

SHA256
d927f2662925da1f4ed1c6abd394c38821fcc0bfae403a119e6a0d80e1d6e538

SHA512
3f243664a4f6253f5cdb189c4d2ad83f4c9fcfbc9021815deaa3f0f44761acca036a84b09bc98b8b25aa1785c28cc1e9809878dcd63143450c091077e841055f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
e6441e4663d7ba1e7db8c307e112736d

SHA1
ca2618e439f25ec3d09ff71aaaa3a7963a15e34f

SHA256
0a5df24add0f3d9b6ed13077cc8e2e8446f4886b36c431e29ae3deb6ade616df

SHA512
5e6b7abfb25dedbf7245d630fa8c755a42738d03c5cf48a95d18c135e1d48e127fccff70ea708cd30cb9f472cd23f9a3bbeb9c6ab92d800dda7b9d5afe66c91a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
5d67f8d72e418f616db1cbac53716196

SHA1
a03a196597af8bc76e5ec38a4349ab958f15345c

SHA256
f67b042113c9f0910c11744950323a952bf91f648f4d01804549508812763595

SHA512
8fb3d53edb962a2ee2fc681b579d5305475bf189a5cf318a092ee153752ed73fafb47960d95526a6e6dcb5ee9c49f22cb2fe9b184468a34922f5a316ee314dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
46749ccf7060a25388530c97e501009b

SHA1
d83128f6170f51ce906176d9ef07867ea4bf0dd9

SHA256
eda72e81a23a7a439892a4cf3ac936aa509179d5f640e6e72424f04087545ac7

SHA512
1a544647ac7e04e67e703f036f2fb8dba78a2d8e377ff9519a7b2880f7e820fe74a00cbf242c50ace20139b905aa27a6c2baf0429781e325e6967f5ebffc0c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
f161d23a0d1979b51f2f98aafab429ae

SHA1
ca4c72288057dfa993b099cd13ac47fec0b57411

SHA256
354bc7fcde38a224b89bbee5d09ca864367242b840b4138a75aec76b41d206c2

SHA512
2b2562782dde24c988f6f1c53964e1d748dda9277fc1922f4fb66ab8fc65507b7964d867e80e7a133aab45d2326e3d55821391a217408cda6ce414947de8dd8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\0448e88c-34c2-4a79-9cb8-ca1f95504480.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
a675eec42d7b5101baae3fd440b2e082

SHA1
9b15bf20f704502a8b13a22023a3cd986c29b510

SHA256
015b56a264efe2f133e279550f254daef93553d545cfae08da681139be54b9e8

SHA512
37d998ac04ebf6b11b402ab88b20832df2a735fcfa452f75b039b1fcdf865b649a1fd8da717e2280803b45976b47c2dfc7a9e840f2f1d3081821a1240e487dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\index

Filesize
256KB

MD5
90bd2b133059bcdd626ec6dfa24bc62c

SHA1
978ccdabf02c206407a82e8a89e65c315ddefaed

SHA256
1ac79e7a42f1ab9aec52c9f055c617074cd81b8920afb9d743c8c75d72dcdfed

SHA512
a893c4d6a4c49df5713d0c6f77fc93f5f4de1dec89b66968276d316be65a6ab52f10af2935fbccd0741a4368ca6a50138c5d6203c8e0dfb0fcd053043f0c7461

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_1\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json

Filesize
1KB

MD5
738e757b92939b24cdbbd0efc2601315

SHA1
77058cbafa625aafbea867052136c11ad3332143

SHA256
d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947

SHA512
dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
7768fdf855a1e05950ad64cab4c6557e

SHA1
159f30feb806c3c4e2ec62cf34bcddef8bd3e347

SHA256
18e33292b1d8cdfccce557a70e278433a039e23f7b143426c48c4ed0ea96a972

SHA512
af71a414d13bb992876746f74c6343320b557e46a66a75c4a0ec900b8d5798b3136f49bca161bb21173e8eb466e2e52c1851f96df5e68ceded45146a27e8bd5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
412be4ad07278882c4ea350d0db497d6

SHA1
315bdc225f955b313db474cea87bdcfea5f842d7

SHA256
39cb8497be5c5d460386856e66b943708e037bfbfda4e35bf3fa8038f2c5a9a8

SHA512
f3007ffa024e6e1432987cc54a98376b2cd1b53742571d36fdce4d9f85ab0c43796cd60412eea1580096be748ef1783a5b54d2896688d4aa4a5e5c8ad036509b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
a156bfab7f06800d5287d4616d6f8733

SHA1
8f365ec4db582dc519774dcbbfcc8001dd37b512

SHA256
e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc

SHA512
6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Network Persistent State

Filesize
2KB

MD5
a293842f8312073f8763f7c2a21292a2

SHA1
7ee611aed3052763510192d9ff4b499133094055

SHA256
2d3d3be9c4e53bcac0cbd7e880a571b7d61c812f36e09adf3320d30d78c9bf60

SHA512
fb1a65264c5a96975ce9040ec44598f3177d7e3e47c6b6609fb233557e6e2c15d04a2d0f6c67debe6cc1a0b94b5a0885c8f13aff5c1d3e7e951995b568f91e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Network Persistent State

Filesize
885B

MD5
01ebb1c1dbb1ba19e33508f917d3b50d

SHA1
aaa68039ec651a4def324498878b98e98b5e6169

SHA256
4b562405946066c9db14131a609247def160d51ddec9cc899e986e57c7bff3ff

SHA512
ae1e0b26fc7cfa7b5ceda998867c3d2dad11851796362b90251679855f44ec8fb8898e9ae4109c64adbcd6795ef8bfb7ec31d9c71a8d2b9e7b72e532803f6fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Reporting and NEL

Filesize
36KB

MD5
fa739570350b78ef09e5d8ca61d0d71f

SHA1
d4e932ca96e76aeb84d3a151d847658df6a5555e

SHA256
951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804

SHA512
8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
7KB

MD5
f71df0a7e3ec326286169f5441e8c9ae

SHA1
c695680fd06ba09a4e84f1ecd54dfa83dafe2c30

SHA256
e5f4162afe94f3f75785b8ba642264de2a25be7850f80e1890638fe5a8f607d5

SHA512
31b03aae27bcbec4b244a1d6b18178c34c3c7f51d9ae47c263c97dc278ad8e69066af88c4a4d7e984ce3621f21538f172b8442f32076fbea84b65759b079e3cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
11KB

MD5
5add355e99dd9dffffaef4f3db17223d

SHA1
884968ace19bd71ca367ad09b06761017cf6db28

SHA256
bd68f2b6f713e8ef382ef6a3a0825ed2c300b5e064afeadd72ea849e3e9a1bce

SHA512
6d5191bc73ee2cf2b0b0b1f7cfd86e4c4dfe946342c780caff4c117a17025fe15f6f1f958d61f427c413e58f1e03ee9085f1d4c3914faddf2ed6da77ca7392ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
4eeac34d55fbb6058edaad0220dc88a9

SHA1
11c9e5cc6642e26ad95fbb15a5a1ffc59fdb6f86

SHA256
aac77b2e7058544e857080bc2aae1792dfe035af5bc0c50afef5fa8bcb89f87b

SHA512
cae8a426d28d866f4ccdc8acc1008bdd10403af097da01e72a7fb02dfa9577bd54ed2354a794d6a85161ff0e9f3eb74f47fb817c2a5e62c5f893adb964331d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
32KB

MD5
d40add4952d35aa5f312067df8fa14cc

SHA1
ea9a4d25082c568d36efdc239e2837e33457d179

SHA256
7b64746ef6a8f6157d919cf6dc7b07e5fbdf296c4c6335eb2bf75355da99261d

SHA512
1c49fca5b12717c840401ea8b67e44b63fc67a3301397f99db28f73d3a5f0766c28d51ecab8a3e3b5cf78d918c10eeaec85e2379aa37dd8a1402d78bb558b464

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
e1f15dda279d61f7811543a6539a9219

SHA1
4c32308460ca7fbf7e6cc9ec446b21ad62388edb

SHA256
4a832c5a104ea6b147c042245c9c7d739695f65a8fd81610b16b845ec616b55a

SHA512
467760290f87becd41cf1c150c052ebba3ba9d80b577ea172ebc9e1a1a477d633f969fd5603c614979401928b9e5d3d867bb99c5fc0d93c68614e34b9de37997

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
32KB

MD5
380eead00b37323cb20cc4dce09f754e

SHA1
afda73acad587e905277c2cbf196da1b72f73323

SHA256
414f8ca1eb5adc288e3c8041729978b19a9411dfc2678d983f393c6841dcb586

SHA512
5b0a98e668eb86a6cd07a0b6e3a27863b9b7d664eeda0f88eeca3b3883ffcac18dfdabc2297c0760d8e85313caf79651c0f938bfcc1c74ef149eed4bb1d4cb93

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ab42c2d6556daf6350bd797657b706ff

SHA1
0f7390c3fab2e43ee13d5689102f0aa829af15bb

SHA256
69b826c6be1ebb5a309bed6556f891c4d1becc601111258b488c7a01be972086

SHA512
b46afcf3b4eadb9bc27328bee6d981c29547ed80d483e84c7bf3d1852ace97311db01ca694803b0f967b4599ea7627e433753b22f49644c9f9f0d94dafe26960

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a865.TMP

Filesize
48B

MD5
84ae152625a8b45b6ca7b2e20d8a2ef4

SHA1
38fca38e7e922825516ec50862ca203cb33d123e

SHA256
2b2ece816bbeb05cf8738fd95a5aa5d37bc4a3644be2f4d137707edf9102a10e

SHA512
05ed6d2b0cb89474d6dbbd28aae74826a617f4e49a0369a8c91fbeacc0706b3a4b4d076873b8e3e040b13297678b3511eda1e6613ef7026da29f7beed292a163

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\cache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\cache\index-dir\the-real-index

Filesize
48B

MD5
d79bbfe4160044f36abce08e2d80bb03

SHA1
2121ee8826fb5ba1a903cb1eeb8ad7eee7bead51

SHA256
5a219ba2473b7dfb878cc0c374654a84cdf2041f3b514c95748f47f44da72fd6

SHA512
0b43d240b1c17a86d058b83f6922cf7e25c4d0a4f76180015dc58e5b4f08aadd4454b193fd5376ec82dc7a38ecc914159c655dc3d55e1187a3d26de522752830

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\db

Filesize
44KB

MD5
b581f0ff8f8aa3371ae47b48c95329e8

SHA1
4f588efadf3675f3526cbe762c50eb8e79d9f2e5

SHA256
f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0

SHA512
e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
291B

MD5
b7f16c6331fa3c4912fd69450f80d958

SHA1
53bf32be3a1c5dd36980188367a8b7bb281ddeef

SHA256
effc7a75e35e2bf9a422fcfd18178ec0015c7fa3758b0c2855fc5b34390890b9

SHA512
c2aae1dde9ddc3b0ca9577b10560dd7e1901e56b1f8e46470022a4e120523830e1f96a573631ac343f188359ffd37630b43f8563a4a93cc9af443fdeda32c038

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
269B

MD5
b908284dba9383e28a26deb5b2623740

SHA1
5cccbad3b7daff36460ddf2283a68e61fedf20b7

SHA256
cb53bc12fdcd625ca07c527508cb7e5c6f702c8837439638c0e49d611d3e0330

SHA512
e2ee878082dad6b9a7a5277db14cf751005d544f3f81c26c1e3f9b17c33c61104eb8ac931a64fbb9c73fdb589d9b8d0253793f4ea1c17dbe0e7b755d82a3bfb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png

Filesize
903B

MD5
166a9c3ecab6cfe73664f783d6d49a89

SHA1
0b9e5c909810c2d2b40df3fd4c8feacebad846c9

SHA256
217f48c637316cfba706de86339bbdb5f6d60c0fab701fc71ba2da01ea71bd99

SHA512
d3da9c250dd728af13e8eb1ee75f420b1857357e7afca9f93090d253fb6cba43bb52b1199725ce3683d7e0411af764333ad2293ada77638847d2526b1b363d3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png

Filesize
1KB

MD5
19f9c11e56103a25a50b9c33be84560b

SHA1
266f57c5a015281d4dd266a9b3dec9cb3a754653

SHA256
2e201cd442e08720a6d4e38516ceea3e892dbc345db1835441e9eec005501c67

SHA512
964e1e6d787450b837f130a4289906ac39277fcd4a98f6314e5aa0450fff81fae275f023c15eb58548ef3ada0b7363e4e6b3d61bb326246f3dc63336d68bb160

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png

Filesize
1KB

MD5
1f695a492ddf318b832bb48f5b9442fc

SHA1
81eb257fc22a30c4e75454ea0e4677043367a6f0

SHA256
a693bf9d32c7ec663b864a2faa9b99d8bb6cb76e332263f5e9a6e3fc2ba60ac5

SHA512
0ad7e376288ec7a2d9314447f2649bb19bb703bedc9710a758e7a15e39083150aa34e2a2e6c22229b324cef4e41c09289c90b445a413336d6eed497f65d8bcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
80KB

MD5
40e7ef72a7b60b5aec2be9f5f1d4f651

SHA1
295c120ba0db619123f9726649bce973512beafb

SHA256
84f0f1700bdc420edc38523644b761de1aa47efa45afb0b633922621d32a6a6a

SHA512
8ae5fa6aeac87d0bb060e5a2c5104b3ff218ce47df4577b68dd37570586d11b41e8a6a22d75710f91c73cebfd2ec8a6f5616291e5d060cb690dc99ea16fb69bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
154KB

MD5
5d673e02fb9dfbf5a6622e17bb10736b

SHA1
d5ce408525d0989aa4dd5760587f776f605ed5c1

SHA256
5f8bfb9824e29064399b51ed320c242d934bcf64c240ccaac3df99596262941f

SHA512
c6de2889fad0c989f530aeb5188e1a3515399b4015a84a4f859b87187518f7660acc306e4557026218edbdd5f2aafbc895d9ac16a1eed0cac6e8bcd73c113bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
47KB

MD5
3923d44ea0f12731f32ca3fc0f74709f

SHA1
142cfc04fe4438106018c8da03f6f0e1f9eccad5

SHA256
03ebd579a557e5a746199035dac341423cf91e793d76361288cd340554d16321

SHA512
a708ff4a9ee4a980dfb3bdb4e413c4eb1fb612ba2dd041fbe63fa68e1830396309709e67a3b6dfe8000c978c91edd0bee7a550d2216f5dacaff169368ebe5a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
40KB

MD5
d1447b28b90c99772d26de3c16d59f41

SHA1
c924425573c539471af7aeb2cc2b00e600bd036b

SHA256
b6820bbbd39825d50827aaebd2951a6aeae84141edc0223f89082e514531fd1b

SHA512
2e8ab2a33c6c9f1bfa8c013c59b42bf0e996cd937b95011e483f5d9e0907570c4436df00eef682e6f8c5f8316642c2f5fb281a30a33b1cd784488af4405c5a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\index

Filesize
256KB

MD5
f0b419ef6eb2f4f4fea69b95ec2f8169

SHA1
61915f2830d12ca93cdbe3e5337840ece96a672e

SHA256
3a5343bc064ca2a138d43617ec1c9581c6f8b13b7acfe5cdd8402d65710f8adf

SHA512
c549bd3fe51fd3d89f70b1a1f3a1410d31c746d6a5366aaa49015f4e5abfa1aab6ce1fc38ca96da9d6c56e0c16d9ad2daf60c435c600909881f3ad046cf35c13

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\b2bcf583-9f45-421f-842a-1dd84cab659d.tmp

Filesize
37KB

MD5
9df720522a737924ac450c1a2c247796

SHA1
ab8f9735914f40ba52086567f6ddadfa69c981a8

SHA256
4bfc15b53e66e7bf92c905923651f9cfcfb7a58123a4c1ee79f55849020f6821

SHA512
1910da5ed5f8dc3bd532a0519c2400cec00b01258dedc2f10c9b12906e10b11a7a1e0b22da1c0870b35409b58994e30f3234de38c1a4457ae9e199a95b5aec03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy5B7F.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5392_1112631418\2ab617f5-5096-40e7-b368-ca2571dc4f10.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_1333133701\CRX_INSTALL\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_1333133701\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_1333133701\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_243383586\4f50abf2-440b-48d3-a1da-2e66d90a54bf.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\xrfofoorukiokfvyycyop

Filesize
4KB

MD5
6224ddef196ff48ffb281549ee916978

SHA1
4ff6cd8c27e1871f5b99202cb86f2afeb3632135

SHA256
7482b7918512a8a68c393999a20163c0de6c9bdf52c2b69f4a12d4f37a76a60b

SHA512
7a42f272806a8e6734f023cf9e5938173d628e4d62e32d77c203d54bd26ef8e529962eecd1670f78186531648dcab1caf524c1ae404dd077b234d5bc6fed0f84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
298bf8078f0359bf1ad9023a1f0ae7ce

SHA1
05f8e9657b97322ad124240e3d30737d85f09a7c

SHA256
f253199c973e17962476fea128d9f1d0d30ea5d92e86afd60af63ac90b747691

SHA512
e67940bbf0993ecbd183d442f98973ac170b9ec9340aab898268e11b54d7e29e45d0a8b05245b899eb294ba5beda8fb75335b47983ee159afd2b7833f840a90e

Download Submit
memory/2060-1565-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-999-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-1559-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-1556-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-1557-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-1561-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-48-0x0000000033680000-0x00000000336B4000-memory.dmp

Filesize
208KB

Download
memory/2060-47-0x0000000033680000-0x00000000336B4000-memory.dmp

Filesize
208KB

Download
memory/2060-44-0x0000000033680000-0x00000000336B4000-memory.dmp

Filesize
208KB

Download
memory/2060-42-0x0000000077D21000-0x0000000077E41000-memory.dmp

Filesize
1.1MB

Download
memory/2060-1555-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-41-0x00000000016E0000-0x0000000002879000-memory.dmp

Filesize
17.6MB

Download
memory/2060-1000-0x0000000033680000-0x00000000336B4000-memory.dmp

Filesize
208KB

Download
memory/2060-1560-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-39-0x00000000016E0000-0x0000000002879000-memory.dmp

Filesize
17.6MB

Download
memory/2060-1566-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-145-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-40-0x0000000077D21000-0x0000000077E41000-memory.dmp

Filesize
1.1MB

Download
memory/2060-160-0x0000000033A90000-0x0000000033AA9000-memory.dmp

Filesize
100KB

Download
memory/2060-159-0x0000000033A90000-0x0000000033AA9000-memory.dmp

Filesize
100KB

Download
memory/2060-156-0x0000000033A90000-0x0000000033AA9000-memory.dmp

Filesize
100KB

Download
memory/2060-35-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2060-25-0x0000000077DC5000-0x0000000077DC6000-memory.dmp

Filesize
4KB

Download
memory/2060-24-0x0000000077DA8000-0x0000000077DA9000-memory.dmp

Filesize
4KB

Download
memory/2060-23-0x00000000016E0000-0x0000000002879000-memory.dmp

Filesize
17.6MB

Download
memory/2060-1558-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/2780-80-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2780-81-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4396-91-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4396-90-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4396-93-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5724-18-0x0000000005010000-0x00000000061A9000-memory.dmp

Filesize
17.6MB

Download
memory/5724-19-0x0000000077D21000-0x0000000077E41000-memory.dmp

Filesize
1.1MB

Download
memory/5724-20-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/5724-22-0x0000000005010000-0x00000000061A9000-memory.dmp

Filesize
17.6MB

Download
memory/5984-89-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5984-92-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5984-106-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download