ee7ca82f38b05b8421e7c34c9e5559d3bad4cd791cbb1ac278eb72008ebd8fe6

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA JULY 521797600.js
Size 794KB
Sample260820-rzbcbasvev
SHA256 ee7ca82f38b05b8421e7c34c9e5559d3bad4cd791cbb1ac278eb72008ebd8fe6
MD5 003b0dfbb4090703b0d1f3b9c612aac4
SHA1 c8c505414fa19e3cc519bfa72fbdffd08d243e48
SHA512 0ff0d7022984ba5555d5ae74de08aa0a7afc94f0f3c35f37534b8c2b05592bec45493d1d56f2735fdcea51394b9c3f12bb9ddefbeefa0853223f7a718ede7bc7
SSDEEP 192:e8iWot6nJQJGymC8NBX6VCq69sOHqe56gdATkGL7s/W8H5aBJRzeckSIY/Y5Rwa8:8
TLSH
T18E051977C2FD2F3EC4275659CE7A3C0C98B054A20B4EF47AED3764C5D87CAAA66A0150
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	440	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
4644	vlc.exe
3060	vlc.exe

Loads dropped DLL 2 IoCs

pid	Process
4644	vlc.exe
3060	vlc.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 47 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svjzeggv6i44x5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5a9c\\vlc.exe\""	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svjzeggv6i44x5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5a9c\\vlc.exe\""	vlc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	chrome.exe
1596	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4644	vlc.exe
4644	vlc.exe
3060	vlc.exe
3060	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
3232	chrome.exe
3232	chrome.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
360	chrome.exe
360	chrome.exe
360	chrome.exe
360	chrome.exe
360	chrome.exe
360	chrome.exe
360	chrome.exe
360	chrome.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe
4644	vlc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	vlc.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeDebugPrivilege	360	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeDebugPrivilege	3060	vlc.exe
Token: SeShutdownPrivilege	1088	chrome.exe
Token: SeCreatePagefilePrivilege	1088	chrome.exe
Token: SeDebugPrivilege	5684	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3232	chrome.exe
3232	chrome.exe
1088	chrome.exe
1088	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4644	440	wscript.exe	90
PID 4644 wrote to memory of 3232	4644	vlc.exe	94
PID 3232 wrote to memory of 1896	3232	chrome.exe	95
PID 3232 wrote to memory of 360	3232	chrome.exe	96
PID 3232 wrote to memory of 4492	3232	chrome.exe	97
PID 3232 wrote to memory of 816	3232	chrome.exe	98
PID 3232 wrote to memory of 1424	3232	chrome.exe	99
PID 3232 wrote to memory of 3428	3232	chrome.exe	100
PID 3232 wrote to memory of 932	3232	chrome.exe	101
PID 3232 wrote to memory of 4368	3232	chrome.exe	102
PID 3232 wrote to memory of 1996	3232	chrome.exe	103
PID 3232 wrote to memory of 1788	3232	chrome.exe	104
PID 4644 wrote to memory of 360	4644	vlc.exe	96
PID 4644 wrote to memory of 360	4644	vlc.exe	96
PID 3060 wrote to memory of 1088	3060	vlc.exe	106
PID 1088 wrote to memory of 4748	1088	chrome.exe	107
PID 1088 wrote to memory of 2452	1088	chrome.exe	108
PID 1088 wrote to memory of 1596	1088	chrome.exe	109
PID 1088 wrote to memory of 724	1088	chrome.exe	110
PID 1088 wrote to memory of 4532	1088	chrome.exe	111
PID 1088 wrote to memory of 5684	1088	chrome.exe	112
PID 1088 wrote to memory of 4648	1088	chrome.exe	113
PID 1088 wrote to memory of 1560	1088	chrome.exe	114
PID 1088 wrote to memory of 4500	1088	chrome.exe	115
PID 1088 wrote to memory of 4172	1088	chrome.exe	116
PID 1088 wrote to memory of 4120	1088	chrome.exe	117
PID 3060 wrote to memory of 5684	3060	vlc.exe	112
PID 3060 wrote to memory of 5684	3060	vlc.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\SOA JULY 521797600.js"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:440
- C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe
  "C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff86365c728,0x7ff86365c734,0x7ff86365c740
      4⤵
      PID:1896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1684,i,11444661936613829255,6631748362033678800,262144 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,11634890943222022996,9614047220458215219,524288 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
      4⤵
      System Time Discovery
      PID:4492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,11785019914189638429,12433917230770405243,524288 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:13
      4⤵
      PID:816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2980,i,1979012096036761020,60802099433247815,2097152 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
      4⤵
      PID:1424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2984,i,9641672267119584295,3234379958477865847,2097152 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3256,i,15646590999707705523,8562195075579929088,2097152 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3292,i,18240806255735695421,15731254705896611151,2097152 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:9
      4⤵
      PID:4368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3828,i,2104372969246990525,18362649332639934079,2097152 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:9
      4⤵
      PID:1996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4284,i,1971989567374805600,17800168712253462191,2097152 --field-trial-handle=1912,i,1154527791101654264,4848907326559256059,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:1788

C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff86365c728,0x7ff86365c734,0x7ff86365c740
    3⤵
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1640,i,106537902328285033,10266335945443134395,262144 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:2452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1832,i,3539725628030806502,6327754081136925963,524288 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,6812249998144358067,3893771887460080537,524288 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
    3⤵
    PID:724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2964,i,9685173840267215323,10401564373110823196,2097152 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2984,i,15187834563799313542,14300787201176566672,2097152 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3276,i,4395350584688226526,7507220725229542743,2097152 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3272,i,16973097667364143219,17657732658413574973,2097152 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:9
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3788,i,16609169736928255303,8840495271922035283,2097152 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:9
    3⤵
    PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4264,i,11866458285259497595,2404283292672073583,2097152 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5241txx0.mpd" --force-high-res-timeticks=disabled --metrics-shmem-handle=4360,i,11761634273404269345,6459154468804638770,524288 --field-trial-handle=2052,i,13651426385405392933,18409029082464453712,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
    3⤵
    PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Crashpad\settings.dat
Size 40B
SHA256 368c5eafa351f8ba952b45789dbb90c64a2f7e6cb4e341863be9859b765531bf
MD5 29bb3d450d35db1d239cf73324884678
SHA1 802f6224dfbdeb9a78f8e9e1011c1b58054ac76c
SHA512 e55bead5540c92d300d9f4e2d88ea9332ec15f18c542233e7a8b3a4d6ed947c78fd165c1635686529279fe661b12aacaa2e0cf623c4e68f66bc305af92ff4547
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 34e69e3a555431fd6cf7693982b0143d28837c3e84e614ee0e7d316b6510089a
MD5 cf6113b949c5715a4ba42e5c95f79c97
SHA1 8bbba13b89631066c8781a4a1a4209d1cc8fdffd
SHA512 d6e7047662193853c1c766ff2c7318e10f0d4f86aed0f469237c3d6e0965a04733183ecda1470ded129b6f8b0e664822e60a76f14d8aba9b174fa1981426d518
SSDEEP 6:/FoEXEZbIBtWNKNNIbe3KeNPkweljYg98K8MbGAuFIll:d7XqMmDbe3KeNsRlcguK8MbGBYl
TLSH
T19A1317BF95CC0F9ACAF2A0BC518B2B3503778168D5613A03D9E13037788D7A3014A00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d60cc1db4fe841f9e90a73f291ec4ed0d31634fa9d7b227a45828cab8cedc969
MD5 081a23622386beaf3dbeb95e6ee46fd4
SHA1 2e0e23de58429403a571dc546a804410d70d3f36
SHA512 e0210550fac4af27a7c1f9562e4bf73f74c19782c7ac2c41ac3c168af6fd5bf481367a8fc18d15e9f8f166d7d59db3e4ccf5711278e3ce6c83de1e4e2df33a15
SSDEEP 24:05+7RjglkxCYGICiZokf2lk3z/mibblwCinnJ6M1CwNOmQ/6lEScBlMmCwNHdsXI:4l9Y95P3zNblw3AM1XgmQ/OKMmXwXm
TLSH
T1D84447F71909D6CBE718CFF45C41513CDD3362162DA6ACBAF12504B352809E73028566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e1fa3dfb0344579c161867ca4e0fc79eec3d165fc3b92147995d36cf157e9871
MD5 a6b4097a06f8096db5cf6d11d42b8dc5
SHA1 0bf35c3635c9a7801da824ee89eca16978f51419
SHA512 88ab39b19b254588e8fd3e95acef246bb9a4f56bc15a4508703b105d2bf733ddc93e0075659b4eea0e4fb257aace88057929d6a1068b9cfd6df1f1d99e695b89
SSDEEP 768:qUfDPLSgcRUv+94aUfDPLSgcRUv++4XUfDPLSgcRUv+h4:qwy
TLSH
T1E1161AB60F64798AE695EF70BBC8DE0C2CB5239CA8575C82F122526D0BE1FC50BC125D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 bac64fdf14fd9e28a161a912caea3ce5fba28f083116548ebca5ffe60ad19d18
MD5 b54e403b66e26efe2129274c2782e535
SHA1 ff75ea5f29a4412c565af7c92929d100703a29c6
SHA512 da9b83932854120b282683eb007fb8e7500a31724c2f7a5d86769643ba68b7963848316c3b7c57846304bbc7e45fb9125575995b96e016dc4c679851bc0f578a
SSDEEP 768:tWYbA9l1nKHdJsoZa0ONDVABoiYhe3oXMSyrxF/4qCUOEaXeZFZwld5Ti6D:0YbKUzrR9B/U+nx/414FUG6D
TLSH
T174030130A5AF2760711EFCC38340F9CE7E0CC7AEA644555E62C7E1874C3436A6B6AE19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Cache\Cache_Data\index
Size 256KB
SHA256 b5b15028a4d1045eefee00fa84f95a933c4690506335d54399276e24e150f52e
MD5 519a85e1913bfed70d96ff2b1d5aef9f
SHA1 316c045601b206cf9277e359838bc2e120580158
SHA512 00d78517a763ff25a0f86e7ce7a642a1bcfb87c0f2bc69fffe9cf2b6dc651be64fc2c850eb82a55462c5467d7c215c80d5eff62ce7ccc5dfc017375f4c64aff6
SSDEEP 3:LsLllfltlNllklkXlEdKl0/lAllx/EWE/ZNtlmNtlYlXlr/wlNlXl:LsRt13lPJ0/lAhEhkNIj
TLSH
T1D144112F8B8A0F08CAE002FC880B8B202338C002C88BC303030020B22CC0BA00F0F0A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 389cfc9f1e54672840e5b0b8f641331fd68b1e1e130d9f5745e164cd5cca3562
MD5 ef9f9d1ac512a8db93b9ee349cbd142c
SHA1 5c5c5d8e1863c8c6ad1ddaec92ac5c992655810a
SHA512 3255658e189946e9729767420e2051f592a7d76e0df4f5fb32ceeb2b3665274cd837834d3f86aade2acbe739a842e72b2a33319ebfb8965da07bd4ca40f3d51d
TLSH
T103E02B81864C1F1DD32DA6F7CDF703044B0A42C429BE7A03A880C6C273524641288123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bc519c831e52c2661b5ba641529d5e173f48ad36cc0345a363b1f534877e0ccf
MD5 8f15a9004a7360c0ee671a903b16d761
SHA1 8b8e4c91a9162479faaf4f24ae06525d354381e6
SHA512 870acc350d927758352b0060f643c8cf788791fb90d935fd8dfc3579fabe64afba51dd7e1c850fa5e9e5bc0cd754a4fa6a18add836157b9df1bb577a2a1da07d
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 27a65f9afbb073e3bd8fd5ca7d1d4528aea0a3645aab9fad6deb81b75dbd53df
MD5 6dbae38926e85aa086b455fadb69e6eb
SHA1 fa4f1fa3867fb01f063a71b4c7e4149af997e0d3
SHA512 02ca7d1888e15576b64ddc9249575aff612ed2f30f4f42fa49c6a3bec75ee507c396d0f3430af821f3304afa5393e2665e5ccba76f9affc4450095f61bf71b03
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\DawnGraphiteCache\index
Size 256KB
SHA256 2d032993fc9dbe690e4fcc7190432fdc0a562fc46de2614ad348a8c6d58d2315
MD5 60d540765a6aee90d1d06da60192c454
SHA1 758fc04557f12d82e2d885d64b71f06520407039
SHA512 111d1110ae1983258664d6eb38bb62086407727b8be8b2b030051a6a9146bcfd80f7e9806180282ea6a56f4fd6001164c5f8e96cfa5d95bf116c95612bc74528
SSDEEP 3:LstlNllklkXleul:LsX3lPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\DawnWebGPUCache\index
Size 256KB
SHA256 aa9864992783e44d8c58e8f6233a273ef1c5d7afa43fec750b3bdf2142d33fb4
MD5 819d04ac69d8dbd355079a3d1525706d
SHA1 791c52385e4e65b480606171e6f834a608d02a1e
SHA512 5f39bec8e6d27573b77d7e96b692c256e92f1196110bc56f63397adfd9df0161fa006f8d0e33e384329f604849723923ad2d2c0b9caa014ac10ed0a0d140653f
SSDEEP 3:LstlNllklkXlzVlll:LsX3lPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Extension Rules\LOG
Size 267B
SHA256 c94378f9b5beddbb03932b2e0e40048df4f227b9bb2b6ff5db68a2cfd582348b
MD5 9d49a9764afb369da6eb488134508a10
SHA1 76b5b6c46148d4c439200c0fed7cd7866a4736d8
SHA512 111c1c2a7cc4034e6e95b5aaddecd843613d5ffd701d9a7c57b7804ffbc77fe8e2f488582a7d19aa60f7dc07a7f76bbb1cd9d9b01f2387cbbcc69660faf5fcb6
TLSH
T105D02B1919CE81AB08A9A497EEE0534DCBB02C1FBB4CBA084F4EC884304384C7291390
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Extension Scripts\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Extension Scripts\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Extension Scripts\LOG
Size 271B
SHA256 80a85f52ccb7df9ebdc88eaa67da1b1e693767701869b29d540c2cb91538795c
MD5 80cc7ac1500208f1ce16cef516371954
SHA1 c46ea9569464515c3d200960b5377c59e84f3759
SHA512 f709595c24e27901738c5d6797ff9b7b725a6440962dcec032bb914b12130253f3e1a6b66495c564e79c0cf87aaa5cec09068fe37c6b41c68717916e5f657222
TLSH
T185D02B1C5CEEC1BB006998D789B1630DCBE0381BBB4CFA084F47CC443047949A551B80
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Extension State\000003.log
Size 228B
SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
MD5 af1d95e1f9eb485393273b25446e1ae5
SHA1 1d762c96b1c38ba6a849a5b76d12fac636b8d780
SHA512 826d207edd55401e1c13249350814adbb3ab00a135c46b8da8bb7267751c70580f183982cccbc1e47bf3e3f433f20ba1d2f2afd601fcb67b635c0e7429558165
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Extension State\LOG
Size 267B
SHA256 17e204ba95117c9c1356513e79baa548e01d01ccdac1e58d2abc7d5da9952718
MD5 11c69f35aeb85e235439b03d0d98dca6
SHA1 3d08c2bf59f67be7de0d03259c39384496208d5b
SHA512 1e4aab975d7b4d9bde23a4b608cbee8c399e7c79ebb4320c3ea90841aecc637f0b1edf81f1ec8a552e0d14b300275a17a9bfcc837065022c5d7f5deba6fe7c71
TLSH
T184D02B6854DFC17B485898A38B25230CCFB1746BBB4CBE084F5BC848204388D6191344
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\GPUCache\index
Size 256KB
SHA256 11c489e21e03880e6518fbcc101807ebdbc4555c4e8ceeac8c3f7936b597c263
MD5 afb6c410cd4deb82e2a065cff65965d7
SHA1 9ebb5a7b5821401ef88129715fa2171f711c9846
SHA512 200a2f0a8b6b18e1d6d438ba216b7bfb4c79b616b5c3f6159a61ae5d0ca3023071467fc10142ec2172c8aed325d647488cc257f5b20f1ebda24abce478a60c74
SSDEEP 3:LstlNllklkXlXl:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Local Storage\leveldb\LOG
Size 279B
SHA256 5296ccc040a1f49e10c2643a7fb5472dfcda545253e6f1422c8be6dafa94ea00
MD5 87d1d63160efb96b055c0da8ece0132c
SHA1 fb377df5cb37da01b410910f6a036250c8ffb7be
SHA512 2924d929029032171f84988d432df2f803f7f93742992fc5092387e7662ea77305c4a1a2ed239bea2ff8247a6cc20da49bf8f2726bb9531d6dcb690f5f9cd572
TLSH
T162D0C27D959B816B1649505BA229730CCF70281AAA8CAB085E96E944318A848A7913C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\4e2wschf.bne\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

libvlc.dll

Path C:\Users\Admin\AppData\Local\Temp\5a9c\libvlc.dll
Size 1.4MB
SHA256 79803ea391bbc139f30426e7d271533fbe17c3b4442ea71ad6bac87281fa4dc1
MD5 59640d249e120524b15599c22d5f8e89
SHA1 c07e7fed67aecb3d1bded894e50ab2e7b55f8a57
SHA512 0b87d48ec61a4bf584bf36730a50cfb9173602381fc730f046a58780b4fe942156fee6b51f449061d2aaf2d6867abcf46cd3a88f883a2b0adedd819ebfa03ee5
SSDEEP 24576:kr8CtDVsmJdL31NYpaN5cPTekphlTxZacuahkVazjvPLLb8Uv7huz3jIXei7RVLz:kr8CtptJ11NYe+TemHZacpI27P78Tz38
TLSH
T1E265C1A42FD024F0E1B5CD75CB67B7B4533F366F1E416FB7112092692E7229AAA03C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Users\Admin\AppData\Local\Temp\5a9c\vlc.exe
Size 1021KB
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 4B
SHA256 9228457e41924897f745f14432dccc5083ab45ed3621d13d67f1581cc1bc85af
MD5 d3b4db01fe9ae00b74af246e3996d27a
SHA1 e7dac68197722d8f5e7e65c6e63fa8ce60623234
SHA512 d8452ef305229d657dab52cd3c3908592e3bb47961c1a1b5ed2e35e6b2630d9382f05d67069a8942d6d0477314d51e578e0cb4f19824b2ac5408aa1d48fde57d
MD5 SHA1 SHA512

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

memory/360-499-0x0000027F0DF30000-0x0000027F0E024000-memory.dmp

Download

memory/3060-196-0x00007FF882840000-0x00007FF882BE1000-memory.dmp

Download

memory/3060-484-0x00007FF60E3D0000-0x00007FF60E4D3000-memory.dmp

Download

memory/3060-698-0x00007FF60E3D0000-0x00007FF60E4D3000-memory.dmp

Download

memory/3060-699-0x0000027E23CA0000-0x0000027E23D3B000-memory.dmp

Download

memory/3060-563-0x0000027E23CA0000-0x0000027E23D3B000-memory.dmp

Download

memory/3060-485-0x0000027E23CA0000-0x0000027E23D3B000-memory.dmp

Download

memory/3060-197-0x00007FF883B30000-0x00007FF883BF7000-memory.dmp

Download

memory/4644-187-0x0000018460130000-0x00000184601D2000-memory.dmp

Download

memory/4644-20-0x00007FF866F70000-0x00007FF8670DF000-memory.dmp

Download

memory/4644-368-0x0000018460470000-0x0000018460476000-memory.dmp

Download

memory/4644-367-0x00000184605B0000-0x00000184606A4000-memory.dmp

Download

memory/4644-370-0x00000184606D0000-0x000001846071C000-memory.dmp

Download

memory/4644-371-0x00007FF866F70000-0x00007FF8670DF000-memory.dmp

Download

memory/4644-195-0x0000018460230000-0x00000184602F8000-memory.dmp

Download

memory/4644-372-0x0000018460960000-0x00000184609B0000-memory.dmp

Download

memory/4644-22-0x00007FF882840000-0x00007FF882BE1000-memory.dmp

Download

memory/4644-23-0x00007FF883B30000-0x00007FF883BF7000-memory.dmp

Download

memory/4644-21-0x00007FF866F70000-0x00007FF8670DF000-memory.dmp

Download

memory/4644-369-0x00000184606A0000-0x00000184606D2000-memory.dmp

Download

memory/4644-19-0x00007FF866FA6000-0x00007FF866FA7000-memory.dmp

Download

memory/4644-18-0x0000018444240000-0x0000018444241000-memory.dmp

Download

memory/4644-558-0x0000018460910000-0x0000018460922000-memory.dmp

Download

memory/4644-560-0x0000018446910000-0x00000184469AB000-memory.dmp

Download

memory/4644-559-0x00007FF60E3D0000-0x00007FF60E4D3000-memory.dmp

Download

memory/4644-561-0x00007FF866F70000-0x00007FF8670DF000-memory.dmp

Download

memory/4644-376-0x00007FF60E3D0000-0x00007FF60E4D3000-memory.dmp

Download

memory/4644-378-0x00007FF866F70000-0x00007FF8670DF000-memory.dmp

Download

memory/4644-377-0x0000018446910000-0x00000184469AB000-memory.dmp

Download

memory/5684-696-0x00000135A4340000-0x00000135A4372000-memory.dmp

Download

memory/5684-695-0x00000135BC700000-0x00000135BC7F4000-memory.dmp

Download