remcos | 195255b4bc9e8153a583a03140e5a6585680b3154154889e56ccbe2f17f0945f

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2025, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ-87868TX.exe
Size

1.3MB
MD5

a20e99ab7a03450723e9dea5f796040d
SHA1

a389e1c7bd5fb577532dae9f12552f28e19f5000
SHA256

195255b4bc9e8153a583a03140e5a6585680b3154154889e56ccbe2f17f0945f
SHA512

071b996c43713e579dad955491505c3cf29baa0d1f0010f8ff62d7e1f4b367ba1b7d0b6dd622a59233018e3d0567f9605ef1d5ff014c5c613876fd2a6d270d53
SSDEEP

24576:lu6J33O0c+JY5UZ+XC0kGso6FaV5EDSVMWcBb7mKyFybSVfWY:nu0c++OCvkGs9FaVGBb7PyzgY

Score

10^/10

remcos remotehost collection credential_access discovery rat stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

45.141.215.102:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KPHE1L
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/892-83-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft
behavioral1/memory/892-107-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft
behavioral1/memory/5148-100-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/5932-124-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/5932-124-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/892-83-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView
behavioral1/memory/892-107-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 15 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2788	msedge.exe
2676	Chrome.exe
5468	Chrome.exe
3228	Chrome.exe
1904	Chrome.exe
1924	msedge.exe
4172	msedge.exe
952	Chrome.exe
1276	Chrome.exe
3532	Chrome.exe
2296	Chrome.exe
4268	Chrome.exe
4296	Chrome.exe
3116	Chrome.exe
1628	Chrome.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3428 set thread context of 4800	3428	RFQ-87868TX.exe	91
PID 4800 set thread context of 892	4800	svchost.exe	106
PID 4800 set thread context of 5932	4800	svchost.exe	107
PID 4800 set thread context of 5148	4800	svchost.exe	109

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_2788_1729550958\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\dasherSettingSchema.json	msedge.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ-87868TX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ-87868TX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133881611119452718"	Chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{3F7142BD-1BE4-4ADE-A402-E4928E389839}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4800	svchost.exe
4800	svchost.exe
2676	Chrome.exe
2676	Chrome.exe
892	recover.exe
892	recover.exe
5148	recover.exe
5148	recover.exe
892	recover.exe
892	recover.exe
4800	svchost.exe
4800	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
5732	RFQ-87868TX.exe
3428	RFQ-87868TX.exe
4800	svchost.exe
4800	svchost.exe
4800	svchost.exe
4800	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	recover.exe
Token: SeShutdownPrivilege	2676	Chrome.exe
Token: SeCreatePagefilePrivilege	2676	Chrome.exe
Token: SeShutdownPrivilege	2676	Chrome.exe
Token: SeCreatePagefilePrivilege	2676	Chrome.exe
Token: SeShutdownPrivilege	2676	Chrome.exe
Token: SeCreatePagefilePrivilege	2676	Chrome.exe
Token: SeShutdownPrivilege	2676	Chrome.exe
Token: SeCreatePagefilePrivilege	2676	Chrome.exe
Token: SeShutdownPrivilege	2676	Chrome.exe
Token: SeCreatePagefilePrivilege	2676	Chrome.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5732	RFQ-87868TX.exe
5732	RFQ-87868TX.exe
3428	RFQ-87868TX.exe
3428	RFQ-87868TX.exe
4800	svchost.exe
2676	Chrome.exe
2676	Chrome.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5732	RFQ-87868TX.exe
5732	RFQ-87868TX.exe
3428	RFQ-87868TX.exe
3428	RFQ-87868TX.exe
4800	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4800	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 2132	5732	RFQ-87868TX.exe	89
PID 5732 wrote to memory of 2132	5732	RFQ-87868TX.exe	89
PID 5732 wrote to memory of 2132	5732	RFQ-87868TX.exe	89
PID 5732 wrote to memory of 3428	5732	RFQ-87868TX.exe	90
PID 5732 wrote to memory of 3428	5732	RFQ-87868TX.exe	90
PID 5732 wrote to memory of 3428	5732	RFQ-87868TX.exe	90
PID 3428 wrote to memory of 4800	3428	RFQ-87868TX.exe	91
PID 3428 wrote to memory of 4800	3428	RFQ-87868TX.exe	91
PID 3428 wrote to memory of 4800	3428	RFQ-87868TX.exe	91
PID 3428 wrote to memory of 4800	3428	RFQ-87868TX.exe	91
PID 2676 wrote to memory of 1896	2676	Chrome.exe	99
PID 2676 wrote to memory of 1896	2676	Chrome.exe	99
PID 2676 wrote to memory of 5840	2676	Chrome.exe	100
PID 2676 wrote to memory of 5840	2676	Chrome.exe	100
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 432	2676	Chrome.exe	101
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102
PID 2676 wrote to memory of 2056	2676	Chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\RFQ-87868TX.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-87868TX.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ-87868TX.exe"
  2⤵
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\RFQ-87868TX.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ-87868TX.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ-87868TX.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4800
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa709dcf8,0x7fffa709dd04,0x7fffa709dd10
        5⤵
        
        PID:1896
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --field-trial-handle=2056,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2052 /prefetch:3
        5⤵
        
        PID:5840
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2020,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2012 /prefetch:2
        5⤵
        
        PID:432
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --field-trial-handle=2508,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2504 /prefetch:8
        5⤵
        
        PID:2056
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3140 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5468
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3172 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:952
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4752,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4748 /prefetch:8
        5⤵
        
        PID:4840
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4268,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4740 /prefetch:8
        5⤵
        
        PID:3008
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4916,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4876 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4296
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4940,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4936 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1276
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5304,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5364 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2296
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5408,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5536 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3532
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5440,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5436 /prefetch:8
        5⤵
        
        PID:1132
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4756,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5152 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4268
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5572,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        
        PID:6060
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5364,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4856 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1904
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4852,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5660 /prefetch:8
        5⤵
        
        PID:4492
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4800,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5436 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3228
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5828,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5940 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3116
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5592,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4912 /prefetch:8
        5⤵
        
        PID:2824
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5756,i,9939358411139532828,5051653147550474497,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5172 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:1628
  - - C:\Windows\SysWOW64\recover.exe
      C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\ncbpjzycemwdwtaxrnocudnpvajg"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:892
  - - C:\Windows\SysWOW64\recover.exe
      C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\yfpikrjvruoizhobiyaefiigdhshpwy"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:5932
  - - C:\Windows\SysWOW64\recover.exe
      C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\izualkuxfcgnjnkfrjnfivcpevkqigohdi"
      4⤵
      PID:4184
  - - C:\Windows\SysWOW64\recover.exe
      C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\izualkuxfcgnjnkfrjnfivcpevkqigohdi"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7fffa607f208,0x7fffa607f214,0x7fffa607f220
        5⤵
        
        PID:5292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2220,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
        5⤵
        
        PID:3004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2700,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
        5⤵
        
        PID:1032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3596,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4308,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4776,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
        5⤵
        
        PID:5204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4804,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
        5⤵
        
        PID:4240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4724,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5572,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
        5⤵
        
        PID:540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5572,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
        5⤵
        
        PID:1420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5632,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
        5⤵
        
        PID:1304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5708,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5964,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
        5⤵
        
        PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6100,i,2330834680680643946,12904741590225557177,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
        5⤵
        
        PID:5376

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2788_431111436\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\ProgramData\remcos\logs.dat

Filesize
176B

MD5
cebd97bb81ad103480403ef78572d929

SHA1
e089ccfa6d16e1cf8fafe156ca362594b38afb36

SHA256
8da738fa42385aa2e24dec763706005ad1e6add2f113143d567e907532ead9ba

SHA512
fd428f1fda78e78e20c330a2c18c60ee7349d5a0dc054cb7285d2c13db3d3fcd4587f2ba2b8922f1bcba5d2262d1aab1dbc60e5daff72bd78443b9d22dc2d864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
ba2c0b516b6f73ac3ece14d9457ac1b4

SHA1
da4862eed10f173a211542dda0ddefcdf72a20f9

SHA256
a3d6c7781479cd8c84ae35104ffe021cfb459221abfe8fb031993416f16cbf9a

SHA512
340f460522394ca839f238b9e98c1aa20257a920251c1ae1cfdd49370f7c3f156428c63a393f4c267b812e27033bb931786d0b8bea27e0a056cb72647412e007

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\4dd22b35-7345-4dbf-9535-b8bf95c0ec1e.tmp

Filesize
37KB

MD5
c7bd59738fb2908b736f5af82f3d215a

SHA1
f99d2080812b9ee3b00f6548b60f105f17a1c2b5

SHA256
3998ff707aa3eb84796abf2169c0973b11a2d9a4fd43c596f9ae074ebae31505

SHA512
2ebc0548537ed3c7ffdd264dc346b939b057b021f02e24bdc9c6c295a0d9171824bde56886b90642238ddc86867bdf8ac569d56b4e884a695871e93f8955f693

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
b0366599d64b0fc1adb2a712dcd02ee1

SHA1
b7a1c09ccd2846664cab5f76bd80b8e9f107acb0

SHA256
ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189

SHA512
d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
d4217e9f8524edd4ef6a2c647bca472c

SHA1
f1dc04cfc7152ca0aa18f427d3dab5e55a4c2539

SHA256
f827736ab99f2f61ba82e7f1c2c148b4bf8a839e544641c08da9d523baf7e2af

SHA512
14f0cffca6968a0bd7210687b2975db8450bbaf80e1508b92338da24124592bd413a8724840860e6df035110551741deb1159798c61fb30c325c39a0201a9850

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
ae95f688930c54a10979929e82f9f056

SHA1
6bf09fda589cd465d4fd2761f3aced6a14d04ed1

SHA256
9ba332d9866a0468889602c627ac26c66b72783d8155daacbb3da19575a5a4a5

SHA512
f78d2b0ed23aa66a96006a6d895ff380895e797c52feab72b8336648c16cba2998cee4c7cbc7a50512a1f94b7a618ea3442f0489bb0322e9676577792b864a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
baa655d97868b6ed7420faf9bd8b60e8

SHA1
11c678610c841544c43f8ef60eb5c28481c20773

SHA256
157e5bb20449a9d4f202d60436ff9ffd45fb5c2decd807ded7516dd9b6e38a5d

SHA512
33f37ce7f763df45c5d1697f2b525c5d0d1937af20d432aed45eda32d36dab7ec4fbeed526e78804ae0cf11913c03e27569d467a8531b949b01e0a0ab88238fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
6cb36e50201a566df9fa13e60ee3ce31

SHA1
93a81d14956877493cee28e366c113d25f03ea74

SHA256
43c7512c7bdbd7d95fc4318a0d063f236fab71a93ae29e038001b0cff8d1cc35

SHA512
555094adbd72e4a822d6678e2bf4384d038dd02714e669da859e56777700dd4f0fa8a1ea7bae1e667fa43f0ebf6835b0a7e94199f2c44e18633fe82f4c9de894

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
280B

MD5
edd6a41f1c5a53defe4aba807b85a2af

SHA1
2bbefcb4a6a39590add58f8e996a51c697e89202

SHA256
4536e3610d1a7172f2b5030012864e2425b9a9a82bddda403f1e551328b02fd4

SHA512
26b80df609341764bf85e8fbdc85f3e517ddb0eac5b5e9387ce87c3694c737faf96ad7708c7012a5f6d86e68b5c3eafdf9eef38617091bc0c237c9be7f0034fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\3c693331-bc4f-40f3-bb50-fdc8c5649107.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
a675eec42d7b5101baae3fd440b2e082

SHA1
9b15bf20f704502a8b13a22023a3cd986c29b510

SHA256
015b56a264efe2f133e279550f254daef93553d545cfae08da681139be54b9e8

SHA512
37d998ac04ebf6b11b402ab88b20832df2a735fcfa452f75b039b1fcdf865b649a1fd8da717e2280803b45976b47c2dfc7a9e840f2f1d3081821a1240e487dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Cache\Cache_Data\index

Filesize
256KB

MD5
d4e8304970ea0e7581d67ef149b066bc

SHA1
3e79fc37da3caa50a5c3e851c532dc48aa03cf17

SHA256
12efe3307660ce0aaa8a9b385ce648545366ba326c43467d05c84a71a79a2dd7

SHA512
b8ca9e28bb64947629f2528adc8f5c5e51cbb7f0874ebd09fbf443c80f7f34c486235a840a205a5317d9fd5d0fdc16c696703d2b52c38ba329aadf9f4e963552

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_1\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\History

Filesize
192KB

MD5
7768fdf855a1e05950ad64cab4c6557e

SHA1
159f30feb806c3c4e2ec62cf34bcddef8bd3e347

SHA256
18e33292b1d8cdfccce557a70e278433a039e23f7b143426c48c4ed0ea96a972

SHA512
af71a414d13bb992876746f74c6343320b557e46a66a75c4a0ec900b8d5798b3136f49bca161bb21173e8eb466e2e52c1851f96df5e68ceded45146a27e8bd5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
3104f0b95461257c28c7a35c6dafc222

SHA1
e1546e3211ca0f1e24bf3d7103745e2522baf146

SHA256
6b543d9a026420bd93b8abb35014f6d03868e3058f2fced1a19427997c97099d

SHA512
098fb5d6ffb82cb6952590e7e0de9ca192671e50c158cab7434446b6d80179250b8d89a140f71c3c6fa700ccd7112ba5bc7d79a2192539b30d57ed2f6a012b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Cookies

Filesize
20KB

MD5
a156bfab7f06800d5287d4616d6f8733

SHA1
8f365ec4db582dc519774dcbbfcc8001dd37b512

SHA256
e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc

SHA512
6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\Network Persistent State

Filesize
2KB

MD5
9d2add314058ea2af822039e49021c7e

SHA1
9f81877702f8a2532d841d76446d7800be2e9ac9

SHA256
98ef0e00dc0e7494b66044979e02c37d5fee9eb230892ec4019a6390cc95416e

SHA512
e37d91571482f6e98e0d2f3a3fe4764724d6051804b664f7d5090b94da402637346c0441fa58d7d1a309ce7bb735504ad80a2a5f02d31691754191e9cf2e3f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
7KB

MD5
61fdfe6a15bb690a67ee7f3181abd28e

SHA1
ec74017ce5695e7a88befd13b2ebf48a352523fd

SHA256
206a678fc40058fec533ca5c14eee9901ba25b263e0e538b7e50a78d08b4302d

SHA512
be6f8aca1614c043bf4fb23a34b636c0da8d22a8e795bd3a4a785868404308cd63ca963066b1deccc56ed2f503b1794b4baa407c7cf74eab3352b1c516a01624

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Preferences

Filesize
11KB

MD5
1f76688e2f0c26bf5cbb1c0acc82da06

SHA1
2f8487a33defa37397ce7f98fa87ead9900dd841

SHA256
d11739c8f227648e90631b15e4ba52b9b8022912d63e8f4401d510624d07e7db

SHA512
d3b2b179d31dba57f90857317d139e5b03c0328152cdc2105ef74b916ba05e4c7543c2cf1b8f6e5f58978fb7f32f746705c5a373938bdee67f62578f037bfe66

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
65949270cb5649ead3377e2ba179c286

SHA1
9e24ab9675fe3b76a6bf0a7530eff2814de7a24b

SHA256
93d00459c5384bbed693a0247cf8c0e227a43a258748a06f13e8d63035322420

SHA512
d3cbf0b2094a6123b7d434cdae76ca39b2decdc21ec2b857ffe81a4b4ca3325cdc4a86b37aaffec89ff13e3e631ae93619d2747f7dd86bd7c827e9cc965fff79

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
32KB

MD5
ba89dccaf726905368188cee9b27d9a8

SHA1
53ec5365eee39f8f176d2c476973387157581705

SHA256
4b52c252ff950241b9d7f5f88316b4a332a259367a6a430632c7da44b62f4895

SHA512
743b18c5a4e912a6b6fd1635b3743019563a6e64ad444e46a215619b3e9ab49a6a2b882dce01370a37421af20270080522a6abf840ee0fde62041c138af8e33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
15KB

MD5
d01c71cae706f6b217ac8ae17da06c57

SHA1
1579da60e97bd263cfcc30de690f8ddd30634f13

SHA256
de71b5a8f2adc8c9676d0f609ee2bd7b0750f8d1670a33299b9109a9c6f73e41

SHA512
d82f3b43403d727824bc9f9d746f250bbeb64d8b00543620854393a741a7d7e71e28c382f6a0805c72ff5750bd91851e1751ec107b9517a032deb87092a6f7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Secure Preferences

Filesize
32KB

MD5
51bba3be8acec8b89ac3039a01985ef0

SHA1
8121866d0d5f2267bbc46380a4834ad42c4d597a

SHA256
a4978961298e10f5d007e963cbba634812222f39298d560f847731829acd442f

SHA512
53846f4a821b454531f9ac14b5bc9a46377612fc3927fb56cf86fb689faf2e48a88b0dd9c51263b210f105de9c23f8fe311e1734277296dd3629ccc5b723f98e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\Database\LOG

Filesize
281B

MD5
6233071c3d1e36ac96d4117519eb5958

SHA1
fdb6e39f198d0a3d24816ebc78a436e4a811a7c2

SHA256
1f363c5754674f0a8570ee9d32a5fa4bcd8564590458f1bddf45a888979e1565

SHA512
ac3f4d4a796a3775cc8ef767d46ff99fb3d667f64e2ba109f85430e4e4813af41cec7988731c2a1b8101df89ea010ef3970ffa6b912a3a51beb222b192daaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4e32402b5f22fc564c1135497f019cc6

SHA1
1427eafe84be11158370a9c0f25d5fec1379d994

SHA256
369030f73a61b9d78ca55a7e34c8dfc5f15e1baae9014e50c6db7be7d4cd3ff5

SHA512
0c37dc7eb36499bf8ee67ea6313420cca788cd954830dd533b3a3d5667f0aadaaeecbc40917e34cba368cd4568dbcf30f88a611288cbfedbaf91a1ab6f4151bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5783b7.TMP

Filesize
48B

MD5
eea9b2bbccf20974acdbf917fef0220d

SHA1
c668a53524482c09250483db7d3b1a9f433be539

SHA256
521cbc7579edc011607765cb50bb578f467f129c63a651d592424906cea0a247

SHA512
08619e53ecd0e161c982e74a558be53aca04b613114744c67c1b81235092ae15ec9302bc6e231158b37cfa66ced63a2cc7842ab17c425596fef2b988fc937d29

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\cache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\cache\index-dir\the-real-index

Filesize
48B

MD5
cb27a83230a4dc56c5b50ccdca02a7a0

SHA1
91e52e8fc5d51ef5c98a398bd5544484984dba7e

SHA256
15576cea847aa6aad3fcba178c433c484a29456c38e40fb8e32e0df9666dd24b

SHA512
717b4f846e1f471a46cf83ef863cd310ae7ca86c5b20f9db1846f72121da6621f5a7cbb63c2dd27c0923b23d8bbe7138a31260d6a9eee5ea18652ed3cca1e1e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Shared Dictionary\db

Filesize
44KB

MD5
b581f0ff8f8aa3371ae47b48c95329e8

SHA1
4f588efadf3675f3526cbe762c50eb8e79d9f2e5

SHA256
f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0

SHA512
e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\000003.log

Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Site Characteristics Database\LOG

Filesize
293B

MD5
352ee4e882541b44a20cad7422c6cab0

SHA1
9e7dcc76c07c7679ffb60e4909348cc0267e1a4c

SHA256
85be9b850b431d0b8f0d7a4b49c7318dd990600a6a6d2eb45532bb4c04eda5f0

SHA512
106672c2275d4140a779cac7c31236718fcb1acf8634b7971a80a03eae80d80b4bfefb974bf7e53e7ab9118bb0848f69392a5ebf25ce94801eaed1c0bac3a17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\000003.log

Filesize
2KB

MD5
d8ba3849a4479a214a302a46c136ce1a

SHA1
37cffb7392c1a3268809a308313f089b2e2c0a6a

SHA256
1bb8905da6f5b0202ea5531aa30b122991d42abdc93fc27eb0548d0e7fb36a14

SHA512
6a8d4ef489496441e93bde407cb21053acf0d54bcad8bde9c98f6290168490f6db4d0134c5b7e00c6ea8031fb3a54ad6a0914e829892331935c4b348161f137b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Sync Data\LevelDB\LOG

Filesize
267B

MD5
17cd190c73956f5ed0a416dfedace682

SHA1
1106a788a08146e183409213d6f5a1526aaa9785

SHA256
7a71773dfbd7dabf60b9e5565773395cb43b1df07d5ae11b740eb1d7018a6a53

SHA512
e7f8d219143e747142934473f956193c07a0496eff570cf39590c66e4dfa77baf25ba93c48f4e5558f096de97dbb9b96d1da25e99ffb66373dec9adf3973d7ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png

Filesize
1KB

MD5
a06bc120408cb7209f3ff0ba4b39d01a

SHA1
7b1df3b761840e87b484603da69837ec705cc082

SHA256
708b95af160bcdc6a17ca93f9b91158944cea75b743b4049a6e6ea299f8c7abf

SHA512
a3869426f4c5af3c225076454b2de0bb0f923eceba687ef7a82ae27b5384c90d03f1e6c1d50efdf8a1e51c1c7ab28ec4742fabe1cf75ef346a31f8037714c1f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png

Filesize
2KB

MD5
eae9011cbfb45db3e8a6a5f5d4f45554

SHA1
6a45d862f6d6658e14a4c925f5a3e25baab6c875

SHA256
9962fe7bd4e81a0dc05e150a0a602db40bdd7dbff114f16adb712b8b749e1898

SHA512
cee11d79da34f767e1aff3771847b8008c0424825102decde2d0d51ea33f9a03262bdabd3938c5948bea95a4fdd46217cb81c1669ff5629e348265a40e30f9c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png

Filesize
3KB

MD5
3c4bbde0c0ec7a7694b78ca833e41ba8

SHA1
e4afa932cecf06e03f59c9b6041ee723e10fcb2d

SHA256
4e0c7afe519c86da175dae1f069379a40694ae49391fdc3c7ccdf5c396e78ade

SHA512
523777c57a8c4d49faed221cbfea7dd589f9c576d2bb9386c6d84e47f5b30762a3012bbd702ea3c51b3f71c48e403b40b297928b94ce36e1a873047d27313006

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
80KB

MD5
99a526e00af09b4d563be0aa31234125

SHA1
2860882c5833cd038ee2699ca684722b70a90795

SHA256
94410193e0337e71192b71df99e25a4e93cf29bceaf5696dbd7cba37d39ded43

SHA512
99914b5314e2e57231823c57df081b4e00f56395d99ee8b7711cc43eda72959bd26da25e33089441a084c102ae351d534e5126d047d8648ca26463344c9aafc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
40KB

MD5
c5407715652e0efb1ff0d9cd67d84140

SHA1
2024b39618524d1482be0137ba3ed10195a97bdd

SHA256
e074b14e4b95f1b42c4aa88a742fff40622a0af38933a3f615670563202d0cd1

SHA512
daa1d816045ac996416115285efd5c7834e5b495dfa0fb3e4e96d5304405f41c9ad3651b0dc24da381089879234f03a7b3dd9db0beb51bae5a4d97c3725fb27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
152KB

MD5
2bedbddd39d75924509e182411174542

SHA1
f7713e1ea594d8cf91a4b72578b29ab6e54e0d52

SHA256
062bb4b6fa32ed5618b27a86e273a8dad6fa93cc1562e6d9c2d0949c89b02b38

SHA512
0b4783447447b4ab7ee25ee35c6d30bec2ed78f6b59afa2a57699243c530bfdb3821008dff4fb50cdfb4abd7362ad19b8e8b605f14fe2acfe2e5e889dc00e587

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Local State

Filesize
46KB

MD5
7ec3f9caf34078617291998ee7bd302a

SHA1
ee58cb525a0c4b00d597cd9b7d2cf6477bdd3924

SHA256
43a82d3f637ff9eed42bf1255d1663151a03c1e5e0d9a4e28cb98c8c1e6c3f10

SHA512
154c595ec0e8af6cc7ef722cc272371ba137fd74b19691097805fba05552bef99a5c139fa2f31be9ce39779934b22ce4be512ab158d6955694ee0a04d0f0bb9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\ShaderCache\index

Filesize
256KB

MD5
4c729291bbef5374b1fff8f0f4d20676

SHA1
c9be1846c2bfe787954eeefba9cff9d6419eed2d

SHA256
f233e1422abcfec386a5a8ccad85825d011f5322785261abf462e390cfc8ad3b

SHA512
60482812f50c9e01854e8c7d1ed664b32bfe0e314c12d94b57276dd1d3092ad6855f2883821b2e70d8773ceea1e5aadd16025f0d83e424192761121da1c322c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Temp\ncbpjzycemwdwtaxrnocudnpvajg

Filesize
4KB

MD5
183a484857c42abff35dc9debdbee6dd

SHA1
7abea0ad337f4bfe11f70ed6ec55e8d19918bed7

SHA256
57366816fad3797dd06c762ebe5b569f13e518f1b95d200395ced430d46a3507

SHA512
9f4b1d43338e7dc29de5bbc97b5f83475e69bdcda035493a2f10ce49b93ba51c082774799eed4840a28264023d0918fd496763a4c7bf153d97bb6ed524f97406

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2676_345804359\f8ea8883-4d7f-4950-b7e7-419376073c23.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2788_2006189284\CRX_INSTALL\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2788_2006189284\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2788_2006189284\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2788_2131443081\d02ad754-070e-447d-a89d-4950e7059d17.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
c701f20dd9389c3c576c9698b699bebd

SHA1
6e1ef17458c0f177a035201c384e1f666d9eb046

SHA256
2308259694d3a22247cf5e254db2067b56bea8c8d13a1b446e6fea1b319c8518

SHA512
8b23e5acbacbf2f7d048b978f3aae5960f793bbc0396725fd85f65481f4c1090feece339ca91aa3bea20bd99ed00e7257f12832e83dbac47084d92974fed5df9

Download Submit
memory/892-83-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/892-107-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3428-14-0x0000000001940000-0x0000000001D40000-memory.dmp

Filesize
4.0MB

Download
memory/4800-19-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-16-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-954-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-37-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/4800-38-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/4800-39-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/4800-34-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/4800-33-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-31-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-30-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-29-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-28-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-27-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-1582-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-1581-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-26-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-897-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-1574-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-24-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-974-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/4800-958-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-1573-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-25-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-23-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-1565-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-156-0x0000000003970000-0x0000000003989000-memory.dmp

Filesize
100KB

Download
memory/4800-20-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-161-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-18-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-17-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-159-0x0000000003970000-0x0000000003989000-memory.dmp

Filesize
100KB

Download
memory/4800-1558-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-15-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-1557-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-1552-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4800-160-0x0000000003970000-0x0000000003989000-memory.dmp

Filesize
100KB

Download
memory/5148-95-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5148-97-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5148-100-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5732-6-0x0000000000E30000-0x0000000001230000-memory.dmp

Filesize
4.0MB

Download
memory/5932-84-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5932-99-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5932-124-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download