bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vlc.exe
Size 1021KB
Sample260820-rhphls11et
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook profiles 1 TTPs 47 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svebt8gph8jist = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svebt8gph8jist = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2416	chrome.exe
2896	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3452	vlc.exe
3452	vlc.exe
2084	vlc.exe
2084	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3512	chrome.exe
3512	chrome.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
4412	chrome.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
4412	chrome.exe
4412	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	vlc.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeDebugPrivilege	4412	chrome.exe
Token: SeShutdownPrivilege	3512	chrome.exe
Token: SeCreatePagefilePrivilege	3512	chrome.exe
Token: SeDebugPrivilege	2084	vlc.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeDebugPrivilege	4176	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3512	chrome.exe
3512	chrome.exe
3400	chrome.exe
3400	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3512	3452	vlc.exe	92
PID 3512 wrote to memory of 2524	3512	chrome.exe	93
PID 3512 wrote to memory of 5728	3512	chrome.exe	94
PID 3512 wrote to memory of 2416	3512	chrome.exe	95
PID 3512 wrote to memory of 2364	3512	chrome.exe	96
PID 3512 wrote to memory of 3296	3512	chrome.exe	97
PID 3512 wrote to memory of 4412	3512	chrome.exe	98
PID 3512 wrote to memory of 2992	3512	chrome.exe	99
PID 3512 wrote to memory of 1688	3512	chrome.exe	100
PID 3512 wrote to memory of 1188	3512	chrome.exe	101
PID 3512 wrote to memory of 1220	3512	chrome.exe	102
PID 3512 wrote to memory of 3432	3512	chrome.exe	103
PID 3452 wrote to memory of 3432	3452	vlc.exe	103
PID 3452 wrote to memory of 3432	3452	vlc.exe	103
PID 3452 wrote to memory of 4412	3452	vlc.exe	98
PID 3452 wrote to memory of 4412	3452	vlc.exe	98
PID 2084 wrote to memory of 3400	2084	vlc.exe	105
PID 3400 wrote to memory of 3608	3400	chrome.exe	106
PID 3400 wrote to memory of 4984	3400	chrome.exe	107
PID 3400 wrote to memory of 2896	3400	chrome.exe	108
PID 3400 wrote to memory of 5548	3400	chrome.exe	109
PID 3400 wrote to memory of 5832	3400	chrome.exe	110
PID 3400 wrote to memory of 4176	3400	chrome.exe	111
PID 3400 wrote to memory of 996	3400	chrome.exe	112
PID 3400 wrote to memory of 3620	3400	chrome.exe	113
PID 3400 wrote to memory of 4532	3400	chrome.exe	114
PID 3400 wrote to memory of 4976	3400	chrome.exe	115
PID 3400 wrote to memory of 1992	3400	chrome.exe	116
PID 2084 wrote to memory of 4176	2084	vlc.exe	111
PID 2084 wrote to memory of 4176	2084	vlc.exe	111

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe8e5fc728,0x7ffe8e5fc734,0x7ffe8e5fc740
    3⤵
    PID:2524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1628,i,94243092929811847,3090079860036414388,262144 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:5728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,4796347917307776887,12853009370743063142,524288 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,13239789064250261890,6971081144629841899,524288 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:13
    3⤵
    PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2968,i,4385134994860661904,11610903235432215632,2097152 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,6274979121961697550,11526889679878045991,2097152 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3208,i,5915785288709027284,11043524867985106263,2097152 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:2992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3236,i,12731863695177143844,9298618691010164150,2097152 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:9
    3⤵
    PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3796,i,2810592375312382126,17658476495419232318,2097152 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:9
    3⤵
    PID:1188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4304,i,14485444586347580660,13006147011094895864,2097152 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4324,i,4551954189918678929,740465803905621716,524288 --field-trial-handle=2004,i,12771815985861756793,6160441516759601889,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
    3⤵
    PID:3432

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe8e5fc728,0x7ffe8e5fc734,0x7ffe8e5fc740
    3⤵
    PID:3608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1676,i,1095585220925546614,11243475451072158206,262144 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:4984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,9814608504987567325,8378666167859721609,524288 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,9759088879152059708,10484412858472550908,524288 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
    3⤵
    PID:5548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2968,i,1646023002460100877,2293103244605319398,2097152 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2972,i,309992490468207190,9908789069960679786,2097152 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3220,i,6082960927669108934,10679700539847894627,2097152 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3244,i,16118615869907342376,2206184401603194297,2097152 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:9
    3⤵
    PID:3620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3776,i,7842582575466478969,4606192193282407582,2097152 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:9
    3⤵
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4284,i,5953264513123102751,13757678774990803343,2097152 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:4976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rjg0t5rk.z3e" --force-high-res-timeticks=disabled --metrics-shmem-handle=4400,i,2430594832083542043,16394692177022904059,524288 --field-trial-handle=2016,i,15078638140066115617,1859328809896544084,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:14
    3⤵
    PID:1992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Crashpad\settings.dat
Size 40B
SHA256 0cb31946dd9bfc698ae9f748f856a2bd1adf6c019d63a4caa85f50c2a5e9b6f9
MD5 4c617244bd25d1929506d6a41e9c06c0
SHA1 a1373ea36ae0ffd4b3a4801e6e531a4ba0092ccd
SHA512 ce7f0391980a56c3bc24ec07ef9db1fba18394908bb95590a0eaa47f152233a7d2af4d7c558eccd2e522d6e2ace65a504466766581ee8b74c5f50887a26e720f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8d7ed6b480d4dc5eeeccde1a1e886119f0c232697d2631db35d366e28d02cd70
MD5 b30f64a1ea8df6c0f907360c7a88471d
SHA1 ecc7a16be845059e93ca493dc2a3a833da81c82f
SHA512 5ed76f976cb3b0386e27314c3f7ca6776fbdae047fe9e52fdea112dc987ec1b5462575743daeb9fa308089414c9d96f837e64bb525a8cbc4fcd9cc16311fb451
SSDEEP 6:/FoEXEiLkNSDqqkK3zK5cLh+LqkEXmrI0+mkllt9El/:d7XuNwqlK3OQ+LqkEmrI0+r/0
TLSH
T183135E2D4B9C2F46E6B620BC1D871BB5B371D808D6419B8381F47A707951346340C600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 62ee878e33ec64d3fd62e65eace58156cffc386b1f8e0fdf1ef3f7c6cab463fb
MD5 98cfcb5dbdcf771f4a7a3922a6585b17
SHA1 ef6215ac752a08b6aa7c1b85f9786bd9b4e265e5
SHA512 3ba31a1ca259e781a4516010bde09b776becffc45a18508aaad217a41189f6d156106c69450f708bf9d393d4a723b1f3b0ee7db8d60731f57d16f74dbc0485fb
SSDEEP 48:qlVY+oP3zlblQLwnAM1XgmQ/7XMkMmXsdVEPLVBKWwtl:ey+uhblQtugDrMkjKVOLHKWol
TLSH
T1EA44B9F71D0CDAC6EB19CBF45C42923C8E3256252DAAEDB9F17844B11150AE731286B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 af2fa1f2f1405fac54f2be1a82559e9a4c83ae372a70211fcf7f4f331204fab2
MD5 ed316405a0d87ce5c37cc77618f47082
SHA1 92135a74bff7507fb45d61c22ffba571acaf61c8
SHA512 aaf5ac8558d983e656ee43df2c9ca01d4d88040f7c75eb4f39856d54ac8a98be5c265647437671d1dabff2bb6cab39928454cb53a8f948064f920808768426a9
SSDEEP 768:DUfDPLSgcRUv+u4iUfDPLSgcRUv+N4kfDPLSgcRUv+E4rUfDPLSgcRUv+m4R7Ogc:ELnVWfKVzdwfKxfK
TLSH
T145165CB60F28B546E685EFB0BBC9DD1C2CB03399AC929C92F12242794AF1FC51BC515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 6e2d18bd5f53b0653b1597f3f096e7bc5a3bf79b56329d7a5c2209e22134a0fc
MD5 8b334065bd8bc237af43054f12fe8960
SHA1 ad8dcda7830c27726b3e8cb1aa1b0089ff629ccc
SHA512 afb88c57264c070ce4e34ae29bbc492c412b3c3518ada81aad7549310d3d254b3510fd041e020911e317a0e2c5cbfc84a089741734b0e3be655e92864a2b9467
SSDEEP 768:HOS6CKuGfZYmxm20omeEFCdNvtwxJtkPC+tx:F6CxWHE2cbFjRkPC+T
TLSH
T11303024C39A7D6AE69C001AAC055D35AF58C4E88D87769A2FE5CF48713173C925D1AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Cache\Cache_Data\f_000002
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Cache\Cache_Data\index
Size 256KB
SHA256 b52e35a2687cbb7d1504521086aac8a1ae0b9d5868e27fb9094f859417e9280d
MD5 23cc343e87b425417b0919941010971c
SHA1 45b4eb7dba9233444cefc0bda78ed9eb9124396a
SHA512 558e2fb8cf37dba1d095c497811d538718bc824be06b570b05262c76b54bc5c344997e7c6611fc243ad9ca08e10d76d0bb3f98767fdae63c2768b1983278cfac
SSDEEP 3:LsLllFlklNllklkXlFU0IV8nXollLll/ncll//ZNtlmNtl3Nl/l5llll/wlNlXl:LsRa3lPTIV8nX4ilthkNHtlll
TLSH
T1DE44112EC3882F02C2C002FCC0838B222338C808EE8FCB0383002A203CC03882E0F020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 d572b6b7a9d894a9edc0da9d21221a4b9940d368488e4869b5040499b6d89393
MD5 04488b823684ecfe2d9572063a08e0fe
SHA1 f2b68ceeae3a6fd4169d4d82c31d408477e549f4
SHA512 5c678841010e609b0fd9b4e93d6a27849a20b9dc6ed598724317637f3dedb47042e80203247143759cf99c1e5b4f32e72f7b59296d5b4a8ece7712b76e0bb00e
TLSH
T1D5E02B91C28C4F0DD33D96F7CDA643058A0A52C429BE7603B880C2C273524281288123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4cb6712efcf060a46c6ef867323e6d14e30795bbad6466d95c15c75c9352da52
MD5 c734300083ef2856839abff8d0a2e1df
SHA1 890adcd9a8594869f918e326ab4ee870dc6a521c
SHA512 05377eaea2684b3f83e6593aa499338a12f45a4cf5fb373f99e7946ed7752e284d1a04f6edd1158f5eef01607c7e2f8d566d8b98b1a0180e0d6cb5cd50d9ce18
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 10c49f442ba14249af2cd488502974c142dfa10ba1b55da2e988fd0f222aef53
MD5 ceb937b24f1e183ec3865f4d09dfe300
SHA1 aee029b72884719ceeb540a367a546f74e09cc08
SHA512 42f0c521630f8bf9211be2557da617c8535ff399d63432ecfe5407ff9d37f377a3f653256ded064af246de3638b8435d880336608755a8cdffd2dc1774fb917c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\DawnGraphiteCache\index
Size 256KB
SHA256 eca1413131a7b142819ffe705e0edefc6270d8eb0e94cb84291be63026345a22
MD5 d8427248d372cf67a2e7fa0adb7ab934
SHA1 1623bfd1046a62af5e5c4d28369483ad891686d4
SHA512 5ed442cc508b9a1e016d906a4fa8eeb70f5600ae1314cbf6b893ce1425593321d96a8b70a8bf2f36a96ee7980737934e34493b79be2b27f5dcbb8c1e053e9c8e
SSDEEP 3:LstlNllklkXlRI:LsX3lPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\DawnWebGPUCache\index
Size 256KB
SHA256 ec8be28fa4fbc477a466b3ca799480cae821d35e896f8573da3ee564fd3c7be5
MD5 5ab908370a1141f839835be8cc6d5f49
SHA1 254da163cf26da1aa79381972d461f9e78ee9f54
SHA512 e57a72a40d0342eab5c189d9f29f22d5efe2720d9ea57f7100ad56f469f96f289f7b875e2e16bbc39127a6b2cb9672b12b27a22fbbdf854f65688849876ec46e
SSDEEP 3:LstlNllklkXlMGkq:LsX3lPMGk
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\GPUCache\index
Size 256KB
SHA256 9de9b425ef649437febb9fff562ba96cb9c203fcb8803e6b460b661e7f101fdd
MD5 f1feb20d5d3a316dadacccb792a4a887
SHA1 ee1f2edfdbb976207ddb9c4b5e82b35cc921f7fa
SHA512 bce383914d62735bbd61f9da19a8306268b320066564c8247d0c4d6a3180bf5b6590d113723000b98c43fbb507394a314dc828b560e1fc248e9323c6c750e02a
SSDEEP 3:LstlNllklkXliq:LsX3lPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 525e5abc33da6048bd0d31753393bcc7abfa0c26e2bc9fcf1a4ab5ba9209171c
MD5 17b92a5bd1e56ad36f9e57bf2ed7a67e
SHA1 2052386ac8513d571216cac1073d889e3b54e2f8
SHA512 5e257836b6cf91d24ea7359ab66ea51ab407d51b9ecee4e43a4feedf9d4e5ab9134b4995c6e4416215956c1a11771f4cb0d63fa4737c43eb9649d8a72078e894
TLSH
T139A002511645C110C22242B42952C7881306B93A90002213BBD5438BDC644554D11554
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 7170693d94cacdb199f1793d79221fd2e7beaa2f0a590fe3ee4c94bb85e71f3b
MD5 3235b1d4fd2392509840e35ba99180be
SHA1 aebadf0fb23c31cfb426ceb19a1f8464217d85c7
SHA512 af0af48bdfa813e98bcc4d5f6ecff3c6fc117a5bff06bfce13de5832e433e9d7a4e8f2ec5178e0de36d04f36d18563c2a8e2a336500eb12c34f9639022fb558b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\GrShaderCache\index
Size 256KB
SHA256 f33050b565fe783d6f52dac45df5d94c9c27b3d42bba4e8f4a10bc64d6193840
MD5 0912ef9027b349acee9234778a52e3ce
SHA1 b8837ec9ece78e66f839824049a2b454054fc354
SHA512 aa346b1dbc6d50b41bd80c00faa9e35b4ff7039215b442fa3b2dffb79749862c9d7375b6b435d9e418189eae627bba0fdbd2ab40cff063298bf1df65e06380ec
SSDEEP 3:LstlNllklkXl8G0Yt:LsX3lP8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\GraphiteDawnCache\index
Size 256KB
SHA256 c4e3bebf8111f333606aaa24dd924d5d02ea873a373d89dc1e86cebb37ad8503
MD5 9b7f754e2500bc40c7725e58cb3bea2a
SHA1 c8eb2688d52cf919010ca0216b1568c237a5b5fd
SHA512 f1f024ae20f2879366337326e7e55923e8d3a24c21f83d8e93a5950ecb64c022723e305046ee322401443accfe5bd30115a88c9429ddc8b8b79347da128970aa
SSDEEP 3:LstlNllklkXlYI:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\tfoxwrgw.zyy\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 4B
SHA256 9228457e41924897f745f14432dccc5083ab45ed3621d13d67f1581cc1bc85af
MD5 d3b4db01fe9ae00b74af246e3996d27a
SHA1 e7dac68197722d8f5e7e65c6e63fa8ce60623234
SHA512 d8452ef305229d657dab52cd3c3908592e3bb47961c1a1b5ed2e35e6b2630d9382f05d67069a8942d6d0477314d51e578e0cb4f19824b2ac5408aa1d48fde57d
MD5 SHA1 SHA512

Submit Download

memory/2084-247-0x00007FFEABD70000-0x00007FFEAC111000-memory.dmp

Download

memory/2084-473-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-248-0x00007FFEADE40000-0x00007FFEADF07000-memory.dmp

Download

memory/2084-245-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-471-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-421-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-472-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-250-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-246-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-805-0x00007FF744EA0000-0x00007FF744FA3000-memory.dmp

Download

memory/2084-667-0x0000020A9A2B0000-0x0000020A9A2E2000-memory.dmp

Download

memory/2084-477-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-806-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-663-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/2084-483-0x00007FF744EA0000-0x00007FF744FA3000-memory.dmp

Download

memory/3452-239-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-234-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-478-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-476-0x00007FF744EA0000-0x00007FF744FA3000-memory.dmp

Download

memory/3452-475-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-474-0x0000028AEB940000-0x0000028AEB972000-memory.dmp

Download

memory/3452-461-0x0000028AEB980000-0x0000028AEBA74000-memory.dmp

Download

memory/3452-1-0x00007FFE96A05000-0x00007FFE96A06000-memory.dmp

Download

memory/3452-2-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-244-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-243-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-242-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-241-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-240-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-238-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-0-0x0000028ACE900000-0x0000028ACE901000-memory.dmp

Download

memory/3452-237-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-236-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-235-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-479-0x0000028AEBDE0000-0x0000028AEBE30000-memory.dmp

Download

memory/3452-233-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-232-0x0000028AEADA0000-0x0000028AEADEC000-memory.dmp

Download

memory/3452-231-0x0000028AEAC80000-0x0000028AEAD58000-memory.dmp

Download

memory/3452-230-0x0000028AEAC00000-0x0000028AEAC7A000-memory.dmp

Download

memory/3452-229-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-228-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-221-0x0000028AEAA30000-0x0000028AEAB02000-memory.dmp

Download

memory/3452-227-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-36-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-7-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-5-0x00007FFEADE40000-0x00007FFEADF07000-memory.dmp

Download

memory/3452-662-0x0000028AEBDC0000-0x0000028AEBDD2000-memory.dmp

Download

memory/3452-4-0x00007FFEABD70000-0x00007FFEAC111000-memory.dmp

Download

memory/3452-665-0x00007FF744EA0000-0x00007FF744FA3000-memory.dmp

Download

memory/3452-666-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/3452-3-0x00007FFE969D0000-0x00007FFE96B8A000-memory.dmp

Download

memory/4176-804-0x000002C2B9AF0000-0x000002C2B9BE4000-memory.dmp

Download

memory/4412-602-0x000001BD903D0000-0x000001BD90402000-memory.dmp

Download

memory/4412-601-0x000001BDA8930000-0x000001BDA8A24000-memory.dmp

Download