bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vlc.exe
Size 1021KB
Sample260820-rhphls11et
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook profiles 1 TTPs 53 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svebt8gph8jist = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svebt8gph8jist = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3888	chrome.exe
3916	msedge.exe
5956	chrome.exe
5860	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	vlc.exe
4568	vlc.exe
4036	vlc.exe
4036	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4264	chrome.exe
4264	chrome.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe
4568	vlc.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	vlc.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeShutdownPrivilege	4264	chrome.exe
Token: SeCreatePagefilePrivilege	4264	chrome.exe
Token: SeDebugPrivilege	4924	chrome.exe
Token: SeDebugPrivilege	3580	msedge.exe
Token: SeDebugPrivilege	4036	vlc.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeShutdownPrivilege	2632	chrome.exe
Token: SeCreatePagefilePrivilege	2632	chrome.exe
Token: SeDebugPrivilege	1176	chrome.exe
Token: SeDebugPrivilege	5312	msedge.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4264	chrome.exe
4264	chrome.exe
2036	msedge.exe
2632	chrome.exe
2632	chrome.exe
4244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4264	4568	vlc.exe	92
PID 4264 wrote to memory of 4188	4264	chrome.exe	93
PID 4264 wrote to memory of 3296	4264	chrome.exe	94
PID 4264 wrote to memory of 3888	4264	chrome.exe	95
PID 4264 wrote to memory of 2276	4264	chrome.exe	96
PID 4264 wrote to memory of 5252	4264	chrome.exe	97
PID 4264 wrote to memory of 3900	4264	chrome.exe	98
PID 4264 wrote to memory of 4924	4264	chrome.exe	99
PID 4264 wrote to memory of 1052	4264	chrome.exe	100
PID 4264 wrote to memory of 2008	4264	chrome.exe	101
PID 4264 wrote to memory of 5044	4264	chrome.exe	102
PID 4264 wrote to memory of 4552	4264	chrome.exe	103
PID 4568 wrote to memory of 4924	4568	vlc.exe	99
PID 4568 wrote to memory of 4924	4568	vlc.exe	99
PID 4568 wrote to memory of 2036	4568	vlc.exe	105
PID 2036 wrote to memory of 5096	2036	msedge.exe	106
PID 2036 wrote to memory of 4672	2036	msedge.exe	107
PID 2036 wrote to memory of 3916	2036	msedge.exe	108
PID 2036 wrote to memory of 2380	2036	msedge.exe	109
PID 2036 wrote to memory of 6040	2036	msedge.exe	110
PID 2036 wrote to memory of 5280	2036	msedge.exe	111
PID 2036 wrote to memory of 552	2036	msedge.exe	112
PID 2036 wrote to memory of 3580	2036	msedge.exe	113
PID 2036 wrote to memory of 5236	2036	msedge.exe	114
PID 2036 wrote to memory of 772	2036	msedge.exe	115
PID 2036 wrote to memory of 5700	2036	msedge.exe	116
PID 2036 wrote to memory of 5472	2036	msedge.exe	117
PID 2036 wrote to memory of 5092	2036	msedge.exe	118
PID 2036 wrote to memory of 1104	2036	msedge.exe	119
PID 2036 wrote to memory of 2768	2036	msedge.exe	120
PID 2036 wrote to memory of 2912	2036	msedge.exe	121
PID 4568 wrote to memory of 3580	4568	vlc.exe	113
PID 4568 wrote to memory of 3580	4568	vlc.exe	113
PID 2036 wrote to memory of 1476	2036	msedge.exe	123
PID 4036 wrote to memory of 2632	4036	vlc.exe	131
PID 2632 wrote to memory of 4492	2632	chrome.exe	132
PID 2632 wrote to memory of 1052	2632	chrome.exe	134
PID 2632 wrote to memory of 5956	2632	chrome.exe	135
PID 2632 wrote to memory of 5904	2632	chrome.exe	136
PID 2632 wrote to memory of 4272	2632	chrome.exe	137
PID 2632 wrote to memory of 1948	2632	chrome.exe	138
PID 2632 wrote to memory of 4184	2632	chrome.exe	139
PID 2632 wrote to memory of 4868	2632	chrome.exe	140
PID 2632 wrote to memory of 5616	2632	chrome.exe	141
PID 2632 wrote to memory of 1176	2632	chrome.exe	142
PID 2632 wrote to memory of 6084	2632	chrome.exe	143
PID 4036 wrote to memory of 1176	4036	vlc.exe	142
PID 4036 wrote to memory of 1176	4036	vlc.exe	142
PID 4036 wrote to memory of 4244	4036	vlc.exe	144
PID 4244 wrote to memory of 2872	4244	msedge.exe	145
PID 4244 wrote to memory of 2524	4244	msedge.exe	147
PID 4244 wrote to memory of 5860	4244	msedge.exe	148
PID 4244 wrote to memory of 5864	4244	msedge.exe	149
PID 4244 wrote to memory of 2272	4244	msedge.exe	150
PID 4244 wrote to memory of 2720	4244	msedge.exe	151
PID 4244 wrote to memory of 6072	4244	msedge.exe	152
PID 4244 wrote to memory of 5232	4244	msedge.exe	153
PID 4244 wrote to memory of 4808	4244	msedge.exe	154
PID 4244 wrote to memory of 5328	4244	msedge.exe	155
PID 4244 wrote to memory of 3608	4244	msedge.exe	156
PID 4244 wrote to memory of 5312	4244	msedge.exe	157
PID 4244 wrote to memory of 2160	4244	msedge.exe	158
PID 4244 wrote to memory of 5148	4244	msedge.exe	159
PID 4244 wrote to memory of 4388	4244	msedge.exe	160

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\larkcriw.10u /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\larkcriw.10u --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc6ed1c728,0x7ffc6ed1c734,0x7ffc6ed1c740
    3⤵
    PID:4188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1708,i,10649986459674765979,7721269940623467492,262144 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    PID:3296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --force-high-res-timeticks=disabled --metrics-shmem-handle=1772,i,8180592223262389921,14668419768317062039,524288 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,16486318366086784947,663512522682421086,524288 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
    3⤵
    PID:2276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2996,i,8351887620655555139,17829760181213130585,2097152 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3012,i,13570336432562233649,8169919367605576890,2097152 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3380,i,16658172022404155425,6356797675121813113,2097152 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3412,i,17536918817623339623,17796495315305829596,2097152 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
    3⤵
    PID:1052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3972,i,2644326526123399692,17143793423130076189,2097152 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4180,i,15553472240901337713,5551404873673506004,2097152 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
    3⤵
    PID:5044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\larkcriw.10u" --force-high-res-timeticks=disabled --metrics-shmem-handle=4168,i,9461965612184316122,3620499824760053770,524288 --field-trial-handle=1928,i,12415593147119378783,17367310046395922007,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
    3⤵
    PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffc6b55c188,0x7ffc6b55c194,0x7ffc6b55c1a0
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,10401740091758203280,10783245017610204045,262144 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1696,i,99957185767294207,13226763629980791832,524288 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2344,i,7220922269861908670,7284780490512999455,524288 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:8
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3112,i,7100649890593657764,13999794917288675277,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3120,i,4402176743274262614,2991509311212495029,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3596,i,14807168109816565464,10672772615874606894,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3604,i,14281431976889549321,5668587619329684629,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3644,i,9568440918302547234,9879662106528018362,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3684,i,16417413367250046080,2325982167561952965,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:2
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3680,i,11200402991266809072,14797499320144222290,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3712,i,166405469282644516,8318777021606664967,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:2
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3720,i,16276069752623480730,11919352669101680429,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3756,i,2709891773737499607,17648199011363581305,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:2
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3852,i,18003158420933093858,1613602428276535593,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3864,i,18074391119577338207,12727664575902557796,2097152 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:2
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f" --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4756,i,2015563534929756231,9924929126929560016,524288 --field-trial-handle=2192,i,18433940792505984748,5662585624815541368,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
    3⤵
    PID:1476

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc6e6cc728,0x7ffc6e6cc734,0x7ffc6e6cc740
    3⤵
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1712,i,108213590973746836,11785432590044650749,262144 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:1052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,3810034381395311718,4011324817863933913,524288 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,17648166531451210193,9535005973872375951,524288 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
    3⤵
    PID:5904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2940,i,17281885166313462570,10222987192120311191,2097152 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,733554021714025335,13295090075144883878,2097152 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
    3⤵
    PID:1948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3340,i,14707100595762717003,671937824743257217,2097152 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3348,i,18211062736669099892,17938191871052578058,2097152 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:2
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3676,i,11246160972540206640,8205202551403705949,2097152 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:2
    3⤵
    PID:5616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3984,i,307014878691160464,10021617549375681991,2097152 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nz03xov2.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=4180,i,7827209023404879255,6464612336416075334,524288 --field-trial-handle=1972,i,16579637548747059872,6230005397234596854,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
    3⤵
    PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffc6af0c188,0x7ffc6af0c194,0x7ffc6af0c1a0
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1732,i,3172921856601084647,4469001714682165934,262144 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,17153685723990552966,1177845676226224063,524288 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,10008046473121392509,4292645583894916022,524288 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3124,i,13108684736680705220,6480142815687314364,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3128,i,6392573911674079105,5583675085302311708,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3588,i,8761196905584555974,11520562756510505150,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3636,i,18297268058818619010,577987256473801838,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:2
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3676,i,15369370055563117211,4571089186239184698,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3732,i,12663347308422700767,13172088619706205770,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:2
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3744,i,8539814818421428341,15005214727973805250,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3784,i,6328460175498414592,5353490964482646472,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3796,i,10241700072936944689,5151239697138592102,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3824,i,10607925162201298621,3260571692078334547,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:2
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3792,i,864810961958575597,14852800344489290276,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3880,i,15676370258325028016,9772878802095698082,2097152 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,1622758077371155715,163688075165688195,524288 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,1233257081933687085,11677747335808362830,524288 --field-trial-handle=2660,i,6785416071871881740,10532148891676158876,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
    3⤵
    PID:4100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f\Crashpad\settings.dat
Size 280B
SHA256 c963b564c912a34416396f57adf865705b2aece70e0560e1ffbd5fb66148feb2
MD5 fe5d9a32970a052bad58bfd3d84e4c9a
SHA1 f80c79b2f8e67916bf0cb4cea2fc6fadad937d41
SHA512 ee2cd5401219b70e69960f18da33253114450c182c97ac1ea9037a406a7434ab372dd5f7e3c6c4862b6c8b0a4f3a45056e1fb3cb6b5aeb1540066332730bc957
TLSH
T19DD001A9AB11AD01E60A257A8179A699A2A6AA96934262106A62542C1A80812419107C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f\Local State
Size 4KB
SHA256 5ceb39214c1913e43d60e919c081eba26604e257b15297b4faf4af249f75209c
MD5 308c9b475c4a62f9ae4675a0c87f6d73
SHA1 e1c23650ce7ced141a45fa7c6b51b0182bb7bd54
SHA512 61ba78c266b3d2188781d031c46e214d309bd714b451f33c5ead1f23cca9e408a37ee1949a6cd1d226fc36d774287990295e02da9f8a24f5a1b5f95965222813
SSDEEP 96:LqGNkcQsFf5Od8tT458Frh/cInURoDotovScDfBkCvIiMctK0eUnshEmADq4a:OGNo8O+ooDUwTpsckqsfJ
TLSH
T19DA18632A534BC778FF2AE45B48A2613AFA82137E4957F55D9D81A1C04DB7A81341C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f\Local State
Size 3KB
SHA256 8af358271126be4974ae6ee2560f7dd11a008bccb85b855506b1b3d8c0aea75a
MD5 c3d5982ae85ba3c768d66bab722d002c
SHA1 9f0d9ccc16f4d66959e30fcd3419d08853c945ee
SHA512 c12dcb8ee211135b0c022e229d44c7f182dd983511e7a0c30f8edf697de3f6df41f538c2f259b1b0b9602a997ab0fe0f1a86137db6842bddc562e04b89ad0bc0
TLSH
T13581A532A4347CB78BF26F89B44A66138FBC716BE5616F55DDC8132804DBA681345833
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe584dae.TMP

Path C:\Users\Admin\AppData\Local\Temp\5ngeyukr.g3f\Local State~RFe584dae.TMP
Size 1KB
SHA256 4085dfec33624a62ec70a3cc81c5966bd7481e11a3d1ac626f02168fe63811f3
MD5 28980707a6cbc6526ed4ddab52538bee
SHA1 8ed5d0373b0c94fa4ee08ff6dcd383fa7e440009
SHA512 82b19e19ebde6789cc7014d8ed2c0ef808b6083e0091555e30bae2fc83f56ca32945da63e52de3cbf0c929fb2aa0020984d7bb51d55724a7af86dad796555516
TLSH
T18131B572E4693CB3A9A16B9AB24DBA131F3C2175D006AF1641ED070D09E7AED170AC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh\Crashpad\settings.dat
Size 280B
SHA256 c2341690e64e141c9ae71406f45ec9fa7441d4a00fb700d3891195358ee421af
MD5 704c76192261a15b060268333febc4f0
SHA1 14f9b0d48b789ed6d8dc63bfccfd1a7f1900d64f
SHA512 9c75a92d4dee94814b6fb7f13962bf10c89f8a0d032456c47b51a93d8d9b999e1b51bef4bdc79228a62b6c151b3398319a8072175fa84b21be6272c6f05e0ad8
TLSH
T1C1D02238E3B08088C08CCBBB0A008380803CCA3800B0A38BF03000A8AC83C0E008FA03
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh\Local State
Size 4KB
SHA256 7ba99c86fc78e86df116bb34c9d1aa55ea6d570ee52b81a779d40e3bcaa86022
MD5 af4a1a3cbabb14d72e15b1b5bc10486a
SHA1 b19f2efc56862b2a7f2876151950a0e9d2720032
SHA512 42ddb6df4fb6805b853a87babbc4f456b873056ac91ace894d17402a729ac4e98894a2f7c9b9a15b49173652bfb666c3155e849d1884379fb937b5bc25204d51
SSDEEP 96:eqGNkfsFf5fHaq1WED6VBqPivU46q17K0eUntkBq4a:lGNU8zZ6rMwncqt3
TLSH
T16681B7B1B425FC236AE6B584B58A36938F783173DC01EF49E6DC571804EB64C2B4D827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh\Local State
Size 5KB
SHA256 d4faf9eceb8311e17b6d5f2ba0c4bda4007e65c4885b68c2ce10fec21d7008db
MD5 0241b504be0762f775218766f23f447f
SHA1 a191a8ab3e160f4f5a21ef9670925237ee27e062
SHA512 c90977a09f3a77c999878a5d2d316575a8d23085bfbb1f3d5a0ce3ee693c5b22604aac96678581af151baf47ebba151199bf9f9fb6dbb2eec73838eabe981744
SSDEEP 96:eqGNkQQsFf5fHaq58Frh/cInURoDotovdPD6GBqPivU46q17K0eUntkBq4a:lGNg8wooDUw96WMwncqt3
TLSH
T17BB1B7B1A425EC275EE6B944B4C63753AFA42133E845FF89E6EC1A0C04E778C1749C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589267.TMP

Path C:\Users\Admin\AppData\Local\Temp\gwofyos2.wgh\Local State~RFe589267.TMP
Size 1KB
SHA256 2551188bd1d0ba2bb436c8b361ced95f7ebf3c3554ef5021873c59cf06113d84
MD5 c956247f302ace2a093ad07c1323b41e
SHA1 d821d11d3b608fdd9722a5dd61f2dd161ae7f95a
SHA512 3df2755be23291547876e4e76cddd2c265fe0614c65fba8951634c787c7a0c74ce041c3c1947bca11326193a2580212e646c97cbf164d854a3dd6fee83c800a7
TLSH
T1D83196B0F854AD33FD91A686524ABB534E341236D045DF4C5AEC161809F768C174DC3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Crashpad\settings.dat
Size 40B
SHA256 6797af9c9a818dc795ff0f9f2b3754ab8f2f5b0b7014020afc3432c65f21d684
MD5 f2319bbd81f48e4484440d17c15392bf
SHA1 d5366149905fdcc04d4bb3aa8059e027f533211a
SHA512 7fa9f2907dd5113082f7bededcbba95267828266289c4364c035dd3908b57a62f81a4fc3c12bc86e6205780285ecc8b7910ef9a1a435e2ba9dce6326a410f58f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 bc069eef71e951747fb0407afbc764abb24eb4ee81769251ffa2e387d28493e6
MD5 88a96990f18b589206f117c9b4f86849
SHA1 99f1db95a34d6aded95c5fb6cb9247a39a2a601a
SHA512 9e2fabf0b2cdf8df79b9212c433be044710ab5812232565aea5008446adec4847472b6b067b9f7b48c5d0746a9a77c1087b4f90e6789f9d79856f2308322ea49
SSDEEP 6:/FoEXEwmmMNRe2C5dAVF57Gy9d0WUqkEXEckll4iQBYw:d7XDmVNRed5dAV3t0WUqkEy/4H3
TLSH
T17813A73C9B8C9E27D1F5103C048B77B053F6C988EAC2675B26FA30BAB40E711004D111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ad877067e3cbb0d885bc3592d0b1a547a05e8e2c934da7a0c513eb729eba24a6
MD5 565a95eefbd9c2361eea3b1781740126
SHA1 95da1c63aa3f4e70c8c439d9316da1e7fd25d1e2
SHA512 905d67f41848e1b10b264800dc5c34eb29948341a105dbf3a5fb4b18c486e08d36628e5681092cc5383f0d3226b86b9414cfb95415ac6e9b9ca6001917f04c4f
SSDEEP 48:0Cl9YSP3zlblQLRlq9AM1XgmQ/7XLKMMmXsdVEPLVBKWwtl:0m6AhblQNldugDrmMjKVOLHKWol
TLSH
T1E344A8F71C09DAC6EB28CBF45C42923C9D3252162DABED79F17944B111509E731286B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 07a68f10b0beebd9849b586cae74b5d2f49f23fe559317b03a6e08d89b4ab8f5
MD5 3762cded2a5fd49b8feb39699a5e946f
SHA1 09926f0547cf7804d4141b0a74e05f3a770e967a
SHA512 7ca6b78fe5079d07f3983e21e9714c8eaac0f5994279b8ee1590fce6c26311ee805f21d52416eb82113f27d5b4e0f1aa78a7ce8b3d963c4ba4d8f5d8b375f54d
SSDEEP 768:wUfDPLSgcRUv+W46UfDPLSgcRUv+F4PfDPLSgcRUv+c4LUfDPLSgcRUv+P4G7ogk:DnI4nfKVzdtfKMfK
TLSH
T1FB165CB60F28B546E695EFB0BBC9DD1C2CB03399AC929C92F12242794AF1FC50BC515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 9e79781563f532dcf9bebff223594c712d882d35e1f678f5029d28d7a1b6cbd5
MD5 258b55f3509447f460f4de0c1c9d2da2
SHA1 ba3ddfae6c1ed5fda842fb0684e7aabcff756135
SHA512 312b7f69e52a22d8691c64c6a86fbb0009d4b7329bdb940792cfbce3016464e30d77959467e5c51a1900c76e93729a16a60b84dc0776700477cb9c1e2b10e227
SSDEEP 768:/F6nUw8coWfXrPZ90GQZxGlfGezlFxrG2sXL8b2wz7GL8ee/fz31wTA1inmf:/F6np8dQOJEfGqgxL8b/besz3snM
TLSH
T10F03F1B302E415A3635FBA0E8D585983F9DD8FEC9C7E784B2260364E0CE46B451F19E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Cache\Cache_Data\f_000002
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Cache\Cache_Data\index
Size 256KB
SHA256 cfc512ca4a17b77b7f115b5d8cdd49b2f272ec365c9057034785b3a9059725cb
MD5 7ddbb045a212698c9f44d62be0360b55
SHA1 e1639451d4f6b3fae0c7c6bef76827a32d4eb5f5
SHA512 06df8b0bc2911f04fa5501ad574781d4963f0d9de195be9004b70ba022df6c185c4459333bb73beccfd2292bae05b883b586a70216f4a78b4db829cefd02b1c4
SSDEEP 3:LsLllFlklNllklkXlWjo8YllLll/mltcll//2NtlNlXl3Nl/l5llll/pNtlQl:LsRa3lPWj64Olt+Nttlllx
TLSH
T14444016ED389AE16C2D402FD84878B68A378C849EE8F974327042A253CC17956E0F1A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 814186531ddcc6cc3866353823a71120c95ec69e66b9eb2fd572abd7c3d93489
MD5 ab1a6dda13068c97aa84373af7f06ee4
SHA1 b967fa60cb7c3411c45590e77f0c4ae91d74821f
SHA512 6430981f8e7337cbc7326e3780d58088f99fd5d59481951768db5907e8e2e6c70d2c5b317f3addb1deacc9de3bb3a4c52f3da6e597a87c2c662dae7c034de689
TLSH
T140E02B91C28C1F1DE32DA6F7CEF603454A0A83C42ABE3603A880C6C133125341248222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1c73cf6f368e791de31828a5e34d4750453d2909262803a40767800e0b5f0b78
MD5 b50c821a629b04dbc3107882bbe99440
SHA1 500f8785fc2137450bac91817f92ead7460ae2f5
SHA512 3bc67fdc40da56e5aef16a2ac0ca9d0d84ff399e033453801368a9505c292f04c34e68380c1a53e6a406ede6432e094e4959d1d2ffa259ad0919cd750ddaf166
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 b973ad37f1094685cde7aded205f42ab78424631a6976f324b5c68660b4b64db
MD5 69b17d23903f87143403bf58ffe2e6a4
SHA1 4dff5fd72bd5d7117cc553299d27c111e7c0a4ee
SHA512 2332bf6606e1628b2132e5cedf39b6d1817df9dbfb76786aaa3353b830dd182a3b6376e7ee782c1c5a97725075c8457c76ca0c0003d3723957879d131b5c1a11
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\GPUCache\index
Size 256KB
SHA256 984a2a87d426f326caef636bb1632043e329786772ea07ee0a12b7339305db50
MD5 46aa6d94f8f3b8181e2d418bd5ce5f8e
SHA1 2bd17922040a1d6e0ddfefa2549dfa22480eda55
SHA512 11496572b11bc763647fcecbf2c38491c679892128d4ee123da7d8c3dd1000defdf55944006409664e353d13072763fc602d81e2c5318e93d40377ae35acb0d2
SSDEEP 3:LstlNllklkXlY4GDX:LsX3lPY4G
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 68c01865aef4574a01c16515314d6e208670b9f27e8128c1f38742bddb210621
MD5 ce85ec0d54ed6c39c80261411904741e
SHA1 0e2f016fd5131403dc73566d7b90beb2dac49e2f
SHA512 682dd31a92c7451e9fe8a9e87454843ff58193bb5e3e4e54808d07ed2e2361c6a2ab5834b6003834aac526e6294f0c894ea0f66cac4b57b3bc55c41ef68aac97
TLSH
T163A002350384C511C15012B92C01839C1200B93584001613B6E11746CCA00655911189
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 7c57714be79b76648cba72e82cffe7e84254d312720436a7c14d87c6e3d7843a
MD5 ba366c2e624595077e79683503081bfa
SHA1 0f96c9f7db53b85c8fd6d1eeb3cbde777fa2997b
SHA512 f7430c6d5c20f5edc818c1f411f50eb16de1ebde31801bc8f636b2c1e017f37e0258243c129d6b79afeab26ea47c59606a99dfe18c3d7d56a8017012082ef119
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\larkcriw.10u\GraphiteDawnCache\index
Size 256KB
SHA256 d63eada1cc3b5fba528817a2f8eaaf7c63b335f6009bd5d225b3d9cc1f8ad357
MD5 871f40345de2f0de3a22c9d7de4fd6ef
SHA1 2331ec29e30a51029d3c3f5f13266a1360d8a9dc
SHA512 54316df8bb0aea1c515f4f8dbdbfd71fa5ad3c57cd042df2eb3e9602bd22a4bba4e0c42e13c42b17e8822bfd249d1453d3254c1ccfa91798cd748b762478e398
SSDEEP 3:LstlNllklkXlujdq:LsX3lP6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 4B
SHA256 9228457e41924897f745f14432dccc5083ab45ed3621d13d67f1581cc1bc85af
MD5 d3b4db01fe9ae00b74af246e3996d27a
SHA1 e7dac68197722d8f5e7e65c6e63fa8ce60623234
SHA512 d8452ef305229d657dab52cd3c3908592e3bb47961c1a1b5ed2e35e6b2630d9382f05d67069a8942d6d0477314d51e578e0cb4f19824b2ac5408aa1d48fde57d
MD5 SHA1 SHA512

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

memory/1176-991-0x00000274A8650000-0x00000274A8744000-memory.dmp

Download

memory/3580-848-0x0000024A145D0000-0x0000024A14602000-memory.dmp

Download

memory/3580-843-0x0000024A2CE00000-0x0000024A2CEF4000-memory.dmp

Download

memory/4036-464-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-459-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-465-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-855-0x000001EEF6DE0000-0x000001EEF6E12000-memory.dmp

Download

memory/4036-467-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-235-0x00007FFC8F4A0000-0x00007FFC8F769000-memory.dmp

Download

memory/4036-460-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-585-0x00007FF7CF790000-0x00007FF7CF893000-memory.dmp

Download

memory/4036-456-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-457-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-458-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-463-0x000001EEF5430000-0x000001EEF5440000-memory.dmp

Download

memory/4036-1201-0x00007FF7CF790000-0x00007FF7CF893000-memory.dmp

Download

memory/4036-236-0x00007FFC8FA00000-0x00007FFC8FABE000-memory.dmp

Download

memory/4568-461-0x000002AABD2E0000-0x000002AABD3D4000-memory.dmp

Download

memory/4568-218-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-230-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-232-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-233-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-234-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-229-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-227-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-228-0x000002AABD160000-0x000002AABD1AC000-memory.dmp

Download

memory/4568-226-0x000002AABD080000-0x000002AABD158000-memory.dmp

Download

memory/4568-225-0x000002AABD000000-0x000002AABD07A000-memory.dmp

Download

memory/4568-224-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-216-0x000002AABCDC0000-0x000002AABCE92000-memory.dmp

Download

memory/4568-468-0x000002AABE740000-0x000002AABE790000-memory.dmp

Download

memory/4568-462-0x000002AABD3F0000-0x000002AABD422000-memory.dmp

Download

memory/4568-851-0x000002AABE790000-0x000002AABE7A2000-memory.dmp

Download

memory/4568-853-0x00007FF7CF790000-0x00007FF7CF893000-memory.dmp

Download

memory/4568-0-0x000002AAA24C0000-0x000002AAA24C1000-memory.dmp

Download

memory/4568-466-0x00007FF7CF790000-0x00007FF7CF893000-memory.dmp

Download

memory/4568-231-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-220-0x000002AAA3680000-0x000002AAA3690000-memory.dmp

Download

memory/4568-2-0x00007FFC8FA00000-0x00007FFC8FABE000-memory.dmp

Download

memory/4568-1-0x00007FFC8F4A0000-0x00007FFC8F769000-memory.dmp

Download

memory/4924-605-0x000002306C480000-0x000002306C574000-memory.dmp

Download

memory/5312-1195-0x00000281BB000000-0x00000281BB0F4000-memory.dmp

Download

memory/5312-1197-0x00000281A17D0000-0x00000281A1802000-memory.dmp

Download