guloader | c84cb91eb22d6788676f2114ad023f2caa70c8ed5ad964e9e7d83056b80ca83a

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

payment.scr
Size

701KB
MD5

e7bbeae6c391accd957b6475dd5f0e63
SHA1

9460741f8eaff856a8163ad5a22c68dd24a0595e
SHA256

2f423571a318924318504db10008bc4cc48afd550c59caf89b40a04c94a890f7
SHA512

83feec2439997a2b9f7a2ae67966d7ab831d8eb9d8d8836746223b05c73e45e48cce3fc5d6ba420907e3c279ae2916d734b366829404786936cb93bc567f18d8
SSDEEP

12288:LR3BUIa3RVtFRe5L7lwvIuBUz3D46l0xFXc3gIwEL:V3GIQHY5vlI7Mnl0Pg73L

Score

10^/10

guloader remcos host-2 collection credential_access discovery downloader rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

Host-2

176.65.142.14:6060

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HM3EZ8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1232-160-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/5500-155-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft
behavioral2/memory/5500-152-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1232-160-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5500-155-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView
behavioral2/memory/5500-152-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 15 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5692	msedge.exe
3376	msedge.exe
2576	Chrome.exe
4688	Chrome.exe
5048	Chrome.exe
524	Chrome.exe
4412	msedge.exe
5988	Chrome.exe
228	Chrome.exe
5348	Chrome.exe
1628	Chrome.exe
5452	Chrome.exe
2648	Chrome.exe
5228	Chrome.exe
5620	Chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
3464	payment.scr
3464	payment.scr

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	drive.google.com
26	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4584	payment.scr

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3464	payment.scr
4584	payment.scr

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 5500	4584	payment.scr	112
PID 4584 set thread context of 1232	4584	payment.scr	114
PID 4584 set thread context of 116	4584	payment.scr	115

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\128.png	msedge.exe
File opened for modification	C:\Program Files (x86)\Common Files\crepe\satanerne.ini	payment.scr
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5692_384753329\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\cy\messages.json	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payment.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payment.scr

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876416798055764"	Chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{42FEBAF7-94DB-4818-80DA-EA33BC071160}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4584	payment.scr
4584	payment.scr
2576	Chrome.exe
2576	Chrome.exe
5500	recover.exe
5500	recover.exe
5500	recover.exe
5500	recover.exe
4584	payment.scr
4584	payment.scr

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3464	payment.scr
4584	payment.scr
4584	payment.scr
4584	payment.scr
4584	payment.scr
4584	payment.scr

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5692	msedge.exe
5692	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2576	Chrome.exe
Token: SeCreatePagefilePrivilege	2576	Chrome.exe
Token: SeShutdownPrivilege	2576	Chrome.exe
Token: SeCreatePagefilePrivilege	2576	Chrome.exe
Token: SeShutdownPrivilege	2576	Chrome.exe
Token: SeCreatePagefilePrivilege	2576	Chrome.exe
Token: SeShutdownPrivilege	2576	Chrome.exe
Token: SeCreatePagefilePrivilege	2576	Chrome.exe
Token: SeShutdownPrivilege	2576	Chrome.exe
Token: SeCreatePagefilePrivilege	2576	Chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4584	payment.scr
2576	Chrome.exe
2576	Chrome.exe
5692	msedge.exe
5692	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4584	payment.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4584	3464	payment.scr	91
PID 3464 wrote to memory of 4584	3464	payment.scr	91
PID 3464 wrote to memory of 4584	3464	payment.scr	91
PID 3464 wrote to memory of 4584	3464	payment.scr	91
PID 2576 wrote to memory of 1484	2576	Chrome.exe	104
PID 2576 wrote to memory of 1484	2576	Chrome.exe	104
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 764	2576	Chrome.exe	106
PID 2576 wrote to memory of 764	2576	Chrome.exe	106
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2984	2576	Chrome.exe	105
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107
PID 2576 wrote to memory of 2584	2576	Chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\payment.scr
"C:\Users\Admin\AppData\Local\Temp\payment.scr" /S
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\payment.scr
  "C:\Users\Admin\AppData\Local\Temp\payment.scr" /S
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4584
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd581adcf8,0x7ffd581add04,0x7ffd581add10
      4⤵
      PID:1484
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1988,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      PID:2984
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --field-trial-handle=2092,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2084 /prefetch:3
      4⤵
      PID:764
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --field-trial-handle=2536,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2528 /prefetch:8
      4⤵
      PID:2584
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3244,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5228
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5988
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4764,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4712 /prefetch:8
      4⤵
      PID:2668
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4852,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4868 /prefetch:8
      4⤵
      PID:3864
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4932,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5348
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4956,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:228
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4868,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4688
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4996,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=3256,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5376 /prefetch:8
      4⤵
      PID:3704
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3604,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5620
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5564,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:1660
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5692,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5688 /prefetch:8
      4⤵
      PID:3536
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5788,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5048
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5064,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5928 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5452
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5496,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5572 /prefetch:8
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5668,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5972 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:524
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5760,i,17686293797319639109,10878979391170104295,262144 --disable-features=PaintHolding --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3388 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:2648
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\vqbpduqgp"
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\vqbpduqgp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5500
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\gkoaemaadilws"
    3⤵
    PID:448
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\gkoaemaadilws"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1232
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\qmtsexlbrqdjczwd"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffd56b9f208,0x7ffd56b9f214,0x7ffd56b9f220
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2188,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2164,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2688,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3544,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3976,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4732,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4680,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4836,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5588,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5588,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5688,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5712,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5844,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5892,i,10536098841521062829,12939069213988753915,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
      4⤵
      PID:3948

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5692_16068280\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
262cb5fb6e850297cfd449e29ce3c206

SHA1
86e06d30ba4407a82ca9a602dd3b96eff736fdc9

SHA256
e5dfd9fd636896fbe176092641a692b3576e8276de97f1db3b5f2df662aeb16c

SHA512
4f46b6834cb05de6bb403f40026eed57b179f62a308522b805f28cb4ed0314cf1c01fe50ee375cbb4b8b039e54870b166d238c4463d64c1f255eedc58af95b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
b0366599d64b0fc1adb2a712dcd02ee1

SHA1
b7a1c09ccd2846664cab5f76bd80b8e9f107acb0

SHA256
ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189

SHA512
d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
693006dda832aee5dc1c7f7f17ac8e70

SHA1
148c3d47dcddf0812591be87da72b8bb5a6e143f

SHA256
7bb218711f098b7784eeda3db8c7f8db543975ee3b25300de152ff96fe92f053

SHA512
6f8c36bc160dde7064f02825a1bd440f2094449436eaf6422b8f25d9b410ca66d5a3ffe221743f9638d4e3f2ac09b46132534deacb2c3b491adecf0aa7afa7dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
55d027e9dd36c52bdc66d0e927cbbd8f

SHA1
81ea4a601db6bc5d7c1fccb66da7c00e97eb50a2

SHA256
e945fe59d7ca51d4e8aafd44d3b2d42d1e7cfd5a299a502ce7744b876a1347d4

SHA512
502c0f7dc30dd1d6c366804b83046caf2175c67a53720fc10d00ece9b5ef998fce302ac5739c8e5b7c92a6809e52cb1975a9355de63b0d6fc859a62f3720486b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
7f2fdbde57ed665913ac30e3757549c6

SHA1
c1cb2fc81824a0bfb24ca6935ca14ad8e86c49dc

SHA256
254bae524d22c10b021de42f5436e7437ba63dc1d9bd9657069757760a1453f1

SHA512
ef7986d534e306a2bea05a36215e50215aa22107ca5ab465b9cdfc2d5aeed7dc91b844963d03e20cd990b88810e6f2943af99b4e8521e5893cc0f9198857073f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
720a0d419b1aa487efe39e93fa730a45

SHA1
3fa204c3402715010da1fb56d39a1afe05186ce3

SHA256
ab1f0a22b25ab701e9becc45392f1c11ccc77726df1b3679453cec4c9551a554

SHA512
d965fb8dc8cc26bf7f10dc9a9aa06125e04d401b8b32b55491b026ff20b4e7ac560b66a52bd473126448548b71603a376909fd3922466b98b7a00cae46ae0fe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
e424671977a08a302226421bc4472547

SHA1
18d123c0b90308bfd8ec8cd8ed4293c340f62cfb

SHA256
1d9d4a965d777d8cadcdb010d983d1af199f27354a0d0dd3eff9de6af1d73351

SHA512
05962803a5a05eff3bb64aa8c6513bf2a750071f5d8f5a4cf613c99a60dc9791e0d29087d52f60b1b2cab63e48550aa8b2b69af6744f8406fd72b41277c46faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
a675eec42d7b5101baae3fd440b2e082

SHA1
9b15bf20f704502a8b13a22023a3cd986c29b510

SHA256
015b56a264efe2f133e279550f254daef93553d545cfae08da681139be54b9e8

SHA512
37d998ac04ebf6b11b402ab88b20832df2a735fcfa452f75b039b1fcdf865b649a1fd8da717e2280803b45976b47c2dfc7a9e840f2f1d3081821a1240e487dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\index

Filesize
256KB

MD5
7956faa3c9703429c6d5cf958d0a7f15

SHA1
cfcd907b436777aae23b19f1763a917659077e23

SHA256
64659d945cbf4c8dc93eefcb5a74f41261ffd0786fce4ccea06f052523e03ec0

SHA512
55639f7802622cd4c2be3ddbbb3d669ae2424bab4d8cf1cddf5d06b748e2f2f83439b8a92b7fda0d554d613579831daa51f0959876662225e531ba2e045895a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_1\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json

Filesize
1KB

MD5
738e757b92939b24cdbbd0efc2601315

SHA1
77058cbafa625aafbea867052136c11ad3332143

SHA256
d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947

SHA512
dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
7768fdf855a1e05950ad64cab4c6557e

SHA1
159f30feb806c3c4e2ec62cf34bcddef8bd3e347

SHA256
18e33292b1d8cdfccce557a70e278433a039e23f7b143426c48c4ed0ea96a972

SHA512
af71a414d13bb992876746f74c6343320b557e46a66a75c4a0ec900b8d5798b3136f49bca161bb21173e8eb466e2e52c1851f96df5e68ceded45146a27e8bd5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
2cabf29f2614f6732e9f94b458ed924a

SHA1
9f714cd18cbe13e3777aea74d55aff39ff735e55

SHA256
abab6f76a6e9e0a7e47c96424db4f6229def941ade5d7931f88d2aa6c0793333

SHA512
1862c57bbc73f29af8512efbac015e731807335d038bbf10074955f0db5d300dee231f332e0d066960368dd776073c98cfd2ffb76d031683618cf51701454a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
a156bfab7f06800d5287d4616d6f8733

SHA1
8f365ec4db582dc519774dcbbfcc8001dd37b512

SHA256
e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc

SHA512
6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Network Persistent State

Filesize
885B

MD5
d0fe13f058c6f597f91e335a34527b3d

SHA1
3d3f6134f91ac4c5fc2b9609d478edc1ede15d84

SHA256
2ea6ea006180efddca77897e1e8df9d4a434507ca54a973a725d4acb74aec617

SHA512
ce3860c16ecb4a4bab605782f4dbc5e47787b21653cb3863046a97192fe6dc24b80813c957ff63794d1164e5833e008cdaa6c071061b472da5f6f86b03a1e4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Network Persistent State

Filesize
2KB

MD5
952f790cbb9d53b135357d521ddc19d0

SHA1
748992cdeb4ba120edba31ebe42339d7d6f832ed

SHA256
5e2537660657547db474410e4bce459f32da9511d9bf8e746842631c283d4346

SHA512
2eae8aae50a7659a67009a469044323a605a278a40de03a234f00461a5de49783a794c2547302b1b5b2d07c6e9068ba80a8d58c98c094a89c73d78bbc5f29fd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Reporting and NEL

Filesize
36KB

MD5
fa739570350b78ef09e5d8ca61d0d71f

SHA1
d4e932ca96e76aeb84d3a151d847658df6a5555e

SHA256
951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804

SHA512
8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
11KB

MD5
fff743b39cb4d343c531f4fa8064efdf

SHA1
f963a484ed29e8459fbcad0ab432f98d89d64d60

SHA256
85d53e02b17ce1f4564cec21f92015ca148114646085350a3fb14e997be7d5ad

SHA512
1765c7f50d4c97a627022f5f22d0100e820e2a5852123b6176a5f001eb34f38b25b96fe04befe65ed6ad735c02f32fc32e1121769967152ff906e2885958b47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
7KB

MD5
e8a6e99cda8a1ea78dc842cf7ceffbdf

SHA1
078ee57ab64bf4d4775eb843903d9e5ee2e79402

SHA256
00a895108ef65e1d15f7897dad64b0bc52e5975376c7861e686eb64088c3e5b0

SHA512
b06ea40eceda7358204db012521b1ddc9e97bc7dfb74a2ced072ed8d124d6b867ef8ae329465d22c78531f8ff02458f17b4dbc8fb0e2bb4e34a22c7a04d06aff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
32KB

MD5
cec143bdcf65c37924a08baf4c45b7b5

SHA1
8f13752e2f9165a402bf722a136ed9a50eca2a3e

SHA256
95b9d3e0bc2be8a659278b99c44b2f983e41e3223f6d44f0b484f7e4f7e3ebbe

SHA512
3df0641b87242b1d8acff4d18843e5a96f92ed452e329860447dd8841b1e8810fdfab9c3345e423bbb50366d04c44ec765be8520fff79cc745b89934590d97a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
4d975031f34c1dbac43ae6e94866aa32

SHA1
c495af65ab4322b97ec204fc6c8f103523ee8fac

SHA256
3ad73d9bb28c4bd4882954b2428ddf690efff1936ccc21284df9ad6805467397

SHA512
53f832687060d81993bf0c50fbcdf1d9f383dd5abf58463bbe4e983b90fc80489451e3cfb9fb2fe2f17beea100aba47976656243a9f83e8a10e91967866a79ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
32KB

MD5
1b0326e114aac12fb60ffc3e2ed48c39

SHA1
46e0f0fe65717dfc24c70e536593f981c762e59c

SHA256
94935d8e5ee66159ed1f65896688818b19720798acace4a266aef15fc914fb36

SHA512
0f972cfc4bda3cd8c1c857952f900921c3ba27e32680e9a81852e9505fb87786538086d950685b5182e97b607b411db138e75db797aa0989a515f7bdc85e8b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
c7431f84d3b7835aa3faf80bd2f6687d

SHA1
c1650ac7c4ea89d51c2a47f2be341ee6dfedeb19

SHA256
8d3d79771087a0acaae8276b1d17997784d263c39b790d1cea3133cb4eb3458e

SHA512
c6d831109bfa271b70253359d912eff79dcd637590a364e38dc056769a35de1b9a79d70cd19b71c8e8e510394b6d1cd075270e081109474e191d752130957110

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a6c66762b51f576a73f2d2db086f8297

SHA1
b01309f914073cd47ff2d516ed4f753d9ad37920

SHA256
2ebda7dcf56de5c06667bf065fbff2d14b0d084d5a63da256ae652403e07c07f

SHA512
7aeb23f5b2264a772fb74db83d9a02ea7ad2438a573fa7ffeb777c95789b5ff68c921f6ede80eb681ec30b62c364a18270a692ef8ef2f193fc9a7166018cc93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a4fa.TMP

Filesize
48B

MD5
b8e5694a3ada4a2eb67598d38a3b50f5

SHA1
7cc8e67bd99745966dd975a5e38670d2e40a2517

SHA256
f3dd60b51e65e6b37398855f348ede10c7025ec2f1fe67b8e0555dc998ee5516

SHA512
8a1061345b0889d12d9579de1e9d7a757ef134dec2285d53bcd74b2a79be9145ed743239aa7204d8a4d31a9db1bded4bb582f625ad1d79e36c6394ef8470512f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\cache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\cache\index-dir\the-real-index

Filesize
48B

MD5
a32d74d96252ee9f2e01c90e8897a7fa

SHA1
5ba4de2a574cda3baefe3388064ee617d88dba0c

SHA256
221abf18bece3242f96b7b9e85d8634ecad2026afc90d6e6467bd526a2df2bb2

SHA512
58b06059f5ba0145ef2d9abf41164736d8b6d1e3b17db3c01999e14fc952dfbd0188213ecda2bb451c2f0d664a4678e7d11a6a9f428348bee16c66de744f5890

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\db

Filesize
44KB

MD5
b581f0ff8f8aa3371ae47b48c95329e8

SHA1
4f588efadf3675f3526cbe762c50eb8e79d9f2e5

SHA256
f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0

SHA512
e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
291B

MD5
9f199a9157c6890e5be010047f4b0952

SHA1
4a5fb8aa7a4cb7a4bd397b9e2959ca7b34a3f559

SHA256
25ef66320f9a7db70bf06cf9cb92d2cf5b1b590e259bca14ddc568cb9f274256

SHA512
003969db425d01c8bef6de51c17ef2d38e73d054d8892103f20684a5d2451ab4262d16a86d7c690653d765596b1d4695fd5989f819ba93c499be35a0118e677e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
269B

MD5
30b892b84df1770b7d7d0c1ba5d77289

SHA1
ffda19cf7cb3a23288739f8317032337ff59e918

SHA256
f3d9ebcf302ad576cda436243cdc2eb2a5e7e40d782052e9cb303e777d71fbf9

SHA512
80e98822db4269dd6556e73f8779a2afe1f96cf7056830cb7de1f04930c8b0b66302fd75f8f4cf9e7fa411ebd7263aa1f4483b110bacb133aba2d756c15778ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png

Filesize
1KB

MD5
2e53a0da3d561ad9fd7d70f2797242d3

SHA1
74c07d8e040d385168885859ebb084dbcfc278f3

SHA256
f18dcb72e3b35b082a4ff8e36897a0e571eea9ce3faa4df01c25db03e242cadb

SHA512
2128a52cd3e8ee8d6485742324409e716cffec6f0a404178d6ebd532948ee6a9b973515a5d68d4f787b914f18427b99d50fd86b391f6e1d9a757bd8eb4bfb0b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png

Filesize
1KB

MD5
d6b943b4b8bbeb32f00a8874ef1e706f

SHA1
5f1666f9f8546e8e044b01f98753016d31467203

SHA256
1957de0f0d150691cf50136cc8af5557c69594578292632284981dc90bcf20c3

SHA512
2dd204e93ab1d6847d3ef182ee35dc9dcc78c5e807d5881aa562f407c7a78a08bdebd0007bc836970691740398dd567e13bfcd256ec07b97a13a26f046675b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png

Filesize
1KB

MD5
5de2b8db0c9986b3eee601b1009ef623

SHA1
9a267178a3ecb89904d1f6a973a659f9ff8dee61

SHA256
26ef3a9f36aac1eca1805249a02f749d420c7d1513847adb25a2e4ec887bd17e

SHA512
1e3e4cc7f663dd47a7ccbf4721f7a0f28eed3df8b5193492279217e30a8b1330131625a1e2030e923a3914593097b700fd2073be66dfda315f38e785fc97f264

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png

Filesize
903B

MD5
166a9c3ecab6cfe73664f783d6d49a89

SHA1
0b9e5c909810c2d2b40df3fd4c8feacebad846c9

SHA256
217f48c637316cfba706de86339bbdb5f6d60c0fab701fc71ba2da01ea71bd99

SHA512
d3da9c250dd728af13e8eb1ee75f420b1857357e7afca9f93090d253fb6cba43bb52b1199725ce3683d7e0411af764333ad2293ada77638847d2526b1b363d3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png

Filesize
1KB

MD5
19f9c11e56103a25a50b9c33be84560b

SHA1
266f57c5a015281d4dd266a9b3dec9cb3a754653

SHA256
2e201cd442e08720a6d4e38516ceea3e892dbc345db1835441e9eec005501c67

SHA512
964e1e6d787450b837f130a4289906ac39277fcd4a98f6314e5aa0450fff81fae275f023c15eb58548ef3ada0b7363e4e6b3d61bb326246f3dc63336d68bb160

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png

Filesize
1KB

MD5
1f695a492ddf318b832bb48f5b9442fc

SHA1
81eb257fc22a30c4e75454ea0e4677043367a6f0

SHA256
a693bf9d32c7ec663b864a2faa9b99d8bb6cb76e332263f5e9a6e3fc2ba60ac5

SHA512
0ad7e376288ec7a2d9314447f2649bb19bb703bedc9710a758e7a15e39083150aa34e2a2e6c22229b324cef4e41c09289c90b445a413336d6eed497f65d8bcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\d99b09e3-d46a-41ea-8802-6be53f40bc6b.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
154KB

MD5
85109f60fd68cda9b504fbb357b27d9d

SHA1
6876a7622e5ef59245af20130a058baae7d2d03a

SHA256
f65a25cbf95348aca192fd2569410b5f5f83ca94d5ecca507956705597caaf0b

SHA512
9cee998bbd18bb58dec8bdf2bd7b654bfc0b506ce1760d1d5839a90425bf7522ed6e05ef826f536a2cabd44e8bf2a05b30254dfed005af1fbb9a39e7aa5dd807

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
47KB

MD5
1e36b292069b5aff9c3e1ebe710da36a

SHA1
bfb904a645c8dc043c43d747fbf40ec121a9393e

SHA256
f522b99e8ca63369742960c61d53b1593a040e550ac7bad58d20c709074b51f8

SHA512
34a6986475f41891d528d4fcf83f136adeda7c9c32609c87d2593b9368bffe9f415eeb58c9796c17e9b2c387703cbdb4f6f7089034fbef826a93bcd3f288722f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
40KB

MD5
b7388abea4980f7e494759d1333e1aac

SHA1
3a7c337d8974fd83c88ea0ad5bc2a0d222bc1f2e

SHA256
45f3c7281a855ea7cfb4112e91d481aa537793a4e4c037cb859def975e071f5d

SHA512
777a5a17ec9e3f00179add0e5eddea895a9603b9ee0446420ae1bfb477935b411120ff7aa6f0b8e70713e41d8ad3a294d8cb51419f4e66a5a03fbb097416b08a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
80KB

MD5
56946b0baf65e2945081b99458cdd726

SHA1
8f96d05cbc53213eb947201d052afcf94cb19ff8

SHA256
82971d0a865a4214015de92b7a364564adb2cb4c0944816c6ccb0d5d6d66ddc0

SHA512
ce06ccd086b71d2d96e116aa0292e5114a2256006394b1882aa3dcee407fbf5c67313811bd7e17b2e56b66169f425c94525b3d38ea534a8b0137f5c9bab336bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\index

Filesize
256KB

MD5
1a13fff889bf26bef80ec7b87bcd92bf

SHA1
2f3104cfee78c3cae4031758982181b05d77e2d5

SHA256
21670ef725a3dc8fbf3c7e05aa3f2301827efbabb0935254cc8d84b59e05ee67

SHA512
cdb71a7e16d1d16dbe89bc3eb66f8137efa825f2b29b83e9616f354a4254946a7f5a04fb79b04340d15a8efdcbf16a9c141eb79a4236b5fad6b3c9e8463ae2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Variations

Filesize
85B

MD5
bc6142469cd7dadf107be9ad87ea4753

SHA1
72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

SHA256
b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

SHA512
47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ec414436-0ac9-4674-8173-e7b850225713.tmp

Filesize
37KB

MD5
f544054a319f9125d3f9213afc754f21

SHA1
c011a412f5d3134ea4a83b245a3b2f9a52b61cef

SHA256
42c7c626b0ae2d95730caf4b636761e5ae8766fd4e8e72ece3136484ec7c86a5

SHA512
8eda82b719ba094c45a5728fbbd3521a7af01e763ca1a44bd56882b7937e49f40975e41e937a7deea7c6f28f0f5eabbce3c13658851cfbb74a535c6a846e7837

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm5881.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2576_1804637705\9c0dd6b3-0578-4d66-a7c7-83a29df39ca7.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_13157644\c3221e47-4caf-4220-abeb-e86ce8454679.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_489289294\CRX_INSTALL\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_489289294\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_489289294\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Local\Temp\vqbpduqgp

Filesize
4KB

MD5
464a2b4d146c111b6f9d38d15973a64a

SHA1
efb2905ba6f5ce2f70d016a956e6858a315236df

SHA256
7d8d3453dac5f9630b1e11bbf62ffcf8a42e84bf76ba341bb9a3f8951bd0ebdd

SHA512
4fdf608b018150abdafe01ed309e134abec621ef2836d07beb57c2304cd37a8bcf58067d34ce3bc37c57040c1aca3db7b2153aaafb33fcbb040637bb8d39306d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4e70d4c4107fc3ee343101c3f1a33e5c

SHA1
f2952b004ab43bf1b507f48c26623b49ba49d58f

SHA256
ed33f9a3d45e3b20dfc1286ceb63d37cf746cea99b03e68847be0c3d577b5a38

SHA512
52b0ef02a9f8fb41f195526ea0a8cfc1209232c309db4e8a283efc0612b26d57f2aca8518bd403e52fdeb1e3387885401865c52889c4ac68caa740c6e721dcd7

Download Submit
memory/116-154-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1232-160-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1232-153-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1232-156-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3464-18-0x00000000038E0000-0x0000000004A79000-memory.dmp

Filesize
17.6MB

Download
memory/3464-19-0x00000000771D1000-0x00000000772F1000-memory.dmp

Filesize
1.1MB

Download
memory/3464-20-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/4584-23-0x0000000077275000-0x0000000077276000-memory.dmp

Filesize
4KB

Download
memory/4584-21-0x00000000016E0000-0x0000000002879000-memory.dmp

Filesize
17.6MB

Download
memory/4584-41-0x00000000338C0000-0x00000000338F4000-memory.dmp

Filesize
208KB

Download
memory/4584-45-0x00000000338C0000-0x00000000338F4000-memory.dmp

Filesize
208KB

Download
memory/4584-38-0x00000000016E0000-0x0000000002879000-memory.dmp

Filesize
17.6MB

Download
memory/4584-999-0x00000000338C0000-0x00000000338F4000-memory.dmp

Filesize
208KB

Download
memory/4584-1038-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1591-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-37-0x00000000771D1000-0x00000000772F1000-memory.dmp

Filesize
1.1MB

Download
memory/4584-1590-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-163-0x0000000033E70000-0x0000000033E89000-memory.dmp

Filesize
100KB

Download
memory/4584-167-0x0000000033E70000-0x0000000033E89000-memory.dmp

Filesize
100KB

Download
memory/4584-33-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-87-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-22-0x0000000077258000-0x0000000077259000-memory.dmp

Filesize
4KB

Download
memory/4584-39-0x00000000016E0000-0x0000000002879000-memory.dmp

Filesize
17.6MB

Download
memory/4584-166-0x0000000033E70000-0x0000000033E89000-memory.dmp

Filesize
100KB

Download
memory/4584-47-0x00000000338C0000-0x00000000338F4000-memory.dmp

Filesize
208KB

Download
memory/4584-46-0x00000000771D1000-0x00000000772F1000-memory.dmp

Filesize
1.1MB

Download
memory/4584-44-0x00000000338C0000-0x00000000338F4000-memory.dmp

Filesize
208KB

Download
memory/4584-1580-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1581-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1582-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1583-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1584-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1585-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1586-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1587-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1588-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/4584-1589-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/5500-152-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/5500-155-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download