b1de4588777902ac32ed8c81ce2ff58a9291438e6fb5fbd9a078a1e1ff0d56da

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Container Booking Request 1 x 40 HC262038470 SSE2514789.js
Size 794KB
Sample260820-xsc58afd28
SHA256 b1de4588777902ac32ed8c81ce2ff58a9291438e6fb5fbd9a078a1e1ff0d56da
MD5 e2ca40a142f836fad46a5c37d21839f4
SHA1 4eb00999a47ded1874a96e94d258012fa40fdb1d
SHA512 ca001dd5e081dc2dcf60b7415b8578fd0394b2223067fb820671a9e3d1296b40dded93531150c025476cfdd167ceebbde4e895d0393b7fa9c7fb529de1200f46
SSDEEP 192:eOetO40ab3VO5UEasXhQLNBJoyuYj8xm+R1NwZatWp9b5IYInWPns8PCLOwv+jrp:Q
TLSH
T130051F7782BE2F6EC82B5658CE7A3C0C5CF05462074EF479EE3BA4C5D47CAD966A0190
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3956	wscript.exe
11	3956	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1480	vlc.exe
5048	vlc.exe

Loads dropped DLL 2 IoCs

pid	Process
1480	vlc.exe
5048	vlc.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 47 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svebt8gph8jist = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\88df\\vlc.exe\""	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svebt8gph8jist = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\88df\\vlc.exe\""	vlc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4676	chrome.exe
1908	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1480	vlc.exe
1480	vlc.exe
5048	vlc.exe
5048	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
240	chrome.exe
240	chrome.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe
1480	vlc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	vlc.exe
Token: SeShutdownPrivilege	240	chrome.exe
Token: SeCreatePagefilePrivilege	240	chrome.exe
Token: SeShutdownPrivilege	240	chrome.exe
Token: SeCreatePagefilePrivilege	240	chrome.exe
Token: SeDebugPrivilege	4676	chrome.exe
Token: SeDebugPrivilege	5048	vlc.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeCreatePagefilePrivilege	1960	chrome.exe
Token: SeDebugPrivilege	1960	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
240	chrome.exe
240	chrome.exe
1960	chrome.exe
1960	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 1480	3956	wscript.exe	89
PID 1480 wrote to memory of 240	1480	vlc.exe	95
PID 240 wrote to memory of 236	240	chrome.exe	96
PID 240 wrote to memory of 2468	240	chrome.exe	97
PID 240 wrote to memory of 4676	240	chrome.exe	98
PID 240 wrote to memory of 4748	240	chrome.exe	99
PID 240 wrote to memory of 4760	240	chrome.exe	100
PID 240 wrote to memory of 5044	240	chrome.exe	101
PID 240 wrote to memory of 5756	240	chrome.exe	102
PID 240 wrote to memory of 3504	240	chrome.exe	103
PID 240 wrote to memory of 1688	240	chrome.exe	104
PID 240 wrote to memory of 1080	240	chrome.exe	105
PID 240 wrote to memory of 1584	240	chrome.exe	106
PID 1480 wrote to memory of 4676	1480	vlc.exe	98
PID 1480 wrote to memory of 4676	1480	vlc.exe	98
PID 5048 wrote to memory of 1960	5048	vlc.exe	108
PID 1960 wrote to memory of 3600	1960	chrome.exe	109
PID 1960 wrote to memory of 3904	1960	chrome.exe	110
PID 1960 wrote to memory of 1908	1960	chrome.exe	111
PID 1960 wrote to memory of 3352	1960	chrome.exe	112
PID 1960 wrote to memory of 2552	1960	chrome.exe	113
PID 1960 wrote to memory of 3608	1960	chrome.exe	114
PID 1960 wrote to memory of 476	1960	chrome.exe	115
PID 1960 wrote to memory of 2936	1960	chrome.exe	116
PID 1960 wrote to memory of 1884	1960	chrome.exe	117
PID 1960 wrote to memory of 4820	1960	chrome.exe	118
PID 1960 wrote to memory of 4944	1960	chrome.exe	119
PID 5048 wrote to memory of 1960	5048	vlc.exe	108
PID 5048 wrote to memory of 1960	5048	vlc.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Container Booking Request 1 x 40 HC262038470 SSE2514789.js"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\88df\vlc.exe
  "C:\Users\Admin\AppData\Local\Temp\88df\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffeb9a7c728,0x7ffeb9a7c734,0x7ffeb9a7c740
      4⤵
      PID:236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,981044115765273124,13028012231606783071,262144 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
      4⤵
      PID:2468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1976,i,5391577923006683475,7311845114422578646,524288 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
      4⤵
      System Time Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2128,i,2353139781456862460,1047252853509420387,524288 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
      4⤵
      PID:4748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2976,i,4039692885882595943,11612941605179981311,2097152 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
      4⤵
      PID:4760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,5640672373126169064,5309029069824978534,2097152 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3204,i,18160646137079524812,15063554814173371597,2097152 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:5756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3212,i,16803481104332063102,6630127239283838534,2097152 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:9
      4⤵
      PID:3504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3764,i,4872125250543396433,16462614602113903685,2097152 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:9
      4⤵
      PID:1688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4332,i,17371249789766842935,11239667728237905312,2097152 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:1080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4364,i,10418265970821053366,4980397186067732292,524288 --field-trial-handle=1892,i,10988914811033542297,17991025568806112160,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
      4⤵
      PID:1584

C:\Users\Admin\AppData\Local\Temp\88df\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\88df\vlc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffeb9a7c728,0x7ffeb9a7c734,0x7ffeb9a7c740
    3⤵
    PID:3600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,16784989698175669261,14138719076428104559,262144 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:3904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,9837273525998463918,786210209955809873,524288 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,7130721843818267396,17307097323267273339,524288 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
    3⤵
    PID:3352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2952,i,13685503753648426901,1367127988354878731,2097152 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2956,i,10322189807742164774,4185194160837570440,2097152 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3148,i,16948990125782296867,13404660835843352907,2097152 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3180,i,10305381973701988787,10461978194266310959,2097152 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:9
    3⤵
    PID:2936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3720,i,17425275278943353043,15110668201702335092,2097152 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:9
    3⤵
    PID:1884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4300,i,7809708158066622935,1920112415395239079,2097152 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ipcsqms2.kfc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4396,i,2255531912953195450,18381769247904845835,524288 --field-trial-handle=2352,i,12403796362063552558,10877676157288478433,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
    3⤵
    PID:4944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libvlc.dll

Path C:\Users\Admin\AppData\Local\Temp\88df\libvlc.dll
Size 1.7MB
SHA256 c0932e0789c154b7af7ea40eac4d9a5e050d3978d4550afbdfb83a08baa70161
MD5 9d75863563ba83642b72c90594af31e6
SHA1 998240c0f55f51c713db24399acb29701d92ef9c
SHA512 9ff05738eb30a5639ef00feb4423055fdc1e72a444e1fbd90fd1c10d0d7c686e919933950015ab879ecd1f2a42b220f27b667b0fdd8b52c09a70dc102470e946
SSDEEP 49152:btUgORNrBPta5OZl/j6nOdA31B3pxHsNWovP:8rRta5OZl/+nh31lpxcX
TLSH
T12E85C0A86FD025F0E2F4CDB1CB6BB6B4537F362F2D416BA7012092753E7215AAA43C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Users\Admin\AppData\Local\Temp\88df\vlc.exe
Size 1021KB
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 12B
SHA256 7b66a65d9dc60c53d41153f03113201ba072136ada37af4b9ded1344e7762df1
MD5 a149ae08ab497d9f4332114aa535b66f
SHA1 51bb2bf519382221ca7ed40929debab8bf3cc170
SHA512 6edb54fc8ba3c7510e8f71711727f9db8e08ea63bff0b9fbebf07c77a63eb67890edf405d36777f984a3f0e594d71173374d1f8c0000c94fb0b4f3af88ebe748
MD5 SHA1 SHA512

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Crashpad\settings.dat
Size 40B
SHA256 ce19cc062e6474ea092196cd7ebf0630a1051c9c51db2e3e7ac6c4fe6acdde40
MD5 5108528665f12aeec05f45b2fd9e84fd
SHA1 771d7486b34d42d1f564679af9931573aa333fec
SHA512 5bd5333cf03e3ca2ce1fde41daba351e7b8e66c447210bf5f6318a68789219ecb8b62f967cca8ebbb1c8d709f1a381b3117d437a8d7657c69a141f605eecaf3f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5636ed91a99fa05ca87f3eef83cda804835ae8079065312512f363cd0848106e
MD5 d5a3466a3c8c7c50cefcfb2dd785e1bf
SHA1 9262fd36d270ccc1fe5347e5b850d98fbcafe183
SHA512 8703c3d882676485c5221526d94117f815c48768eca376ac418071c006199acc90d309771471634021669c510bec925ee56dcd7dc757c296ce16ddd9ba09e8e6
SSDEEP 6:/FoEXEMC+EC+CkNuiEC+EB9IEYg9U5i2mqOltD3sLoaYpFI:d7X/C+EC+nNXEC+EDIEYg25MqOXD2UI
TLSH
T11613173CBAD10D26CA92B4BC2F0B1BB813BC86C89A242FE710B130212549B320909006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 fef61395c82d8d21d2e35bddb1065b54d5ca2e79a7c166037c7e382129d01566
MD5 2b73bca8e038fb671eedbd4e2b334314
SHA1 1d31023304be53bdaa4691113a952ece13a42b58
SHA512 59de234dc2c048e35e7748630e6a873aac5de663bea2ce51def276cd8647133cba6a52e820b656256a7eaf46beafb8616f86e47e93232e742cfe1fd904f43e34
SSDEEP 48:dlXzY2P3zlblQ+KicAM1XgmQ/VxMmXwX3dVEPLVBKWwtl:nX0chblQSpugDVxjwtVOLHKWol
TLSH
T14C44B6F72D48EAC6EB18DBF45D41923C8E3246252CABEDB9F17844B11151AF731286B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 044bf7f0c980089815564b32ceeb2138ad0f044e9438cffa96cc55d861f3c677
MD5 c864b9a4be9f36b3789fa830ae777d27
SHA1 f1c334671c1ddc94b6f4e36d0459ab07bd61db20
SHA512 f7429e8a6642613be3ad40384a5d856fd0d72f82158be7e9d4ef5105b6fcec5e0ddd4d084c46998c3d437b9c74ab261212d0b66a90a570a16e2d9694e53e5a52
SSDEEP 768:tUfDPLSgcRUv+A49UfDPLSgcRUv+34NUfDPLSgcRUv+64AfDPLSgcRUv+d4fg7VY:Im7aWlfKVzd1kfK+RfK
TLSH
T13A165CB60F24B546E685EFB0BBC9DD1C2CB033A5EC96AC92E12242794AF1FC507C515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 3b61fa46485cfcc8db7a06548edb24f39b9c472103739723511d4bc03bfc7d9f
MD5 d734eb213ee78675991916084e988a9c
SHA1 a43dfec11c58fd3905979a772166097d13421aa8
SHA512 8b42ae4e50beba3c6f3c434a630a4e1867b62b1a7558d7373803805b34cd9ac4b8568b643f9cb6f2de9c406bd58ab5c04ad3ad924ed5dbc937d66127c3528440
SSDEEP 768:9vDzYcRzOI34Gxcs088pCU7ozl7BqcZlKbOl9zXrkHOG8:9HYTIoRs0Bvszl7BqIfzrkO
TLSH
T1BC03F1527FFDE4E8CB4DBD91198CB89FF339472906BBA522BCB9D4D105844AF8099601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Cache\Cache_Data\f_000002
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Cache\Cache_Data\index
Size 256KB
SHA256 b22abaed91dbfdad3743b1447aecc808a9cac7aecac25cc4e1f8a2da4a5b6d66
MD5 54912f89460ea847d4f2676098f40860
SHA1 a7393d6dc0f4110d6999af0a226faebd95c966f4
SHA512 12fdf28ca15565e035b96487e0b5847ec2bbe8e521518cd7041135ab673f00483c28cf2dc6f19feca4d9bf5e92d7839210fa6edd1e9d126623f05f11d4877678
SSDEEP 3:LsLllFlklNllklkXlNRqYllLll/nWE/ZNtlmNtlYlXlr/wlNlXl:LsRa3lPfqI4EhkNIj
TLSH
T1AC44122E83C00E09C6C015FC848347203338C044CA4F9743030025103CC07611E0F058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 5331c7e7cbde79db2dfe0654ed779c221d6b2c0653a742751bbda4e37a23edf6
MD5 bd173fad5abbd668bd1e92ff15dd83be
SHA1 35d20a5b802f01055a0cbd53fe37d4a4c56a0e8c
SHA512 94ac518cb32749b1e3adf7cb658f25abd47d1d2cb54f1de1f18022d166f522e544c3b7ce0f4c7db1e541debaafa54295ed8078c095102c49c7dddb2a4db66f7c
TLSH
T16CE02B89828D0F0DD32D96F7CDAB03444B0A42C42ABE3603A880C2C233128645248223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 f94eeb5ca80350c9aa2fba53e8e9603e988c8d86a5a7978e2a79d3c261f6c1bb
MD5 c7e1ffcd7c60a2ae9b70b9442a1ebf00
SHA1 86166bfa78d46f2fb7d39d8c46c0a348939365a6
SHA512 a6de15a93b774cc061bdb8ad1bcb86536ed5e335acd5767891189e2ee6252088da24eb64ca84320ef84fb11015aa5755b9c04ab1a2f5c550a7641c687e4ee2ad
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\DawnGraphiteCache\index
Size 256KB
SHA256 aec60bcc5bbe21b6de9463a3c33169a8b06693362ace341d121587530f125bed
MD5 ba2e46b098fd94b450478eadb498e134
SHA1 7d049c08ca2389440b8e85737cab87649616f839
SHA512 a4711d14408bd28ffa098d74efe92440664d2c035a24054f9ce1adf90e1e90a0ff1d89f4016db47fdef97d19fd7b002f2d2499621cb28e27413d50fcff017b9c
SSDEEP 3:LstlNllklkXlLbm1:LsX3lPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\DawnWebGPUCache\index
Size 256KB
SHA256 492f5774c96519b49c495de6385b023bf9f5bc54a1fd096e2441a09b56f3b137
MD5 9006c015b079be3ce96e28228041d47c
SHA1 8d9e209cf2abe9d0d673c979bfc99020620ec593
SHA512 e3b845c11d9a6478d690959ec00967060dac70f9ee96f44430a00a9f547ad588475f07446c3d4e247ee190b1ef212e5c09b8e862b2029e4d1b0f0e97d1bfc54b
SSDEEP 3:LstlNllklkXluw:LsX3lP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\GPUCache\index
Size 256KB
SHA256 e8eb616ec941dddcaee34f4fe2893fad776d5353941f9eae54ed377eb272b7b7
MD5 a1b2740e40810d632b8573c13775dd27
SHA1 5e37806412ef226a322661cfa0f5406eb401a52e
SHA512 8e0ad99fd8e09c75f0331bc9119913f4043375b764dbfdf43710c0055f3697211b8cd9cd2efe8810d835171212a9ea7827df0deb35b2153dce6548f6a05702a0
SSDEEP 3:LstlNllklkXl9:LsX3lP9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 84dc36260159333d72838aeb68c80fae6fb919e143f7dc6c7fb0425c008ec4a0
MD5 0cca7c0a57b3a2d48c730378fef2a73f
SHA1 9c22314c7a828c87dc7ef5b33f0e00ee2e897feb
SHA512 fc0d71f4237412160097f29b28e49a48537477328211ac6961e8cf2dc47fff1545fdc82d5461492bfc37240eee768f63b69a2c4e6965cc85a7b6fa9467f47f43
TLSH
T12DA0025256918110C14062F0A941C7883211BAA984C0465376D00386CCE00604965145
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 482c9282e27a2c7f50acbc9faf2277b0c93f4dbe813ce7305f5103a908dd7a29
MD5 cc864c7ebcef99a641f947a7df580d03
SHA1 ce2777e8e09d725a83aabc9a4cd50f93cb96bb52
SHA512 482c8ff75e287dc5b3bf7cd043d1418fc9fcc18ffbad0da429f0ef8f714733b1c2c5b14f9cdc751d6f98b27f8a6e2b5c87d6da964175ff3e4ec0d9572eaf3f97
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\yt5ncrjm.tso\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-22-0x00007FFEDB300000-0x00007FFEDB3C7000-memory.dmp

Download

memory/1480-236-0x000001F2EE840000-0x000001F2EE912000-memory.dmp

Download

memory/1480-663-0x00007FFEC02F0000-0x00007FFEC04AA000-memory.dmp

Download

memory/1480-662-0x000001F2ED830000-0x000001F2EE1D4000-memory.dmp

Download

memory/1480-246-0x000001F2EFC20000-0x000001F2EFC6C000-memory.dmp

Download

memory/1480-661-0x00007FF7CB5A0000-0x00007FF7CB6A3000-memory.dmp

Download

memory/1480-473-0x000001F2F0380000-0x000001F2F03D0000-memory.dmp

Download

memory/1480-472-0x00007FFEC02F0000-0x00007FFEC04AA000-memory.dmp

Download

memory/1480-471-0x000001F2ED830000-0x000001F2EE1D4000-memory.dmp

Download

memory/1480-470-0x00007FF7CB5A0000-0x00007FF7CB6A3000-memory.dmp

Download

memory/1480-469-0x000001F2EFED0000-0x000001F2EFF02000-memory.dmp

Download

memory/1480-468-0x000001F2EFF10000-0x000001F2F0004000-memory.dmp

Download

memory/1480-660-0x000001F2F0350000-0x000001F2F0362000-memory.dmp

Download

memory/1480-245-0x000001F2EFB00000-0x000001F2EFBD8000-memory.dmp

Download

memory/1480-244-0x000001F2EFA80000-0x000001F2EFAFA000-memory.dmp

Download

memory/1480-19-0x00007FFEC0325000-0x00007FFEC0326000-memory.dmp

Download

memory/1480-21-0x00007FFED9D40000-0x00007FFEDA0E1000-memory.dmp

Download

memory/1480-18-0x000001F2EC560000-0x000001F2EC561000-memory.dmp

Download

memory/1480-20-0x00007FFEC02F0000-0x00007FFEC04AA000-memory.dmp

Download

memory/1960-800-0x0000021825FB0000-0x00000218260A4000-memory.dmp

Download

memory/4676-597-0x0000017775B20000-0x0000017775C14000-memory.dmp

Download

memory/4676-609-0x000001775D2F0000-0x000001775D322000-memory.dmp

Download

memory/5048-248-0x00007FFEDB300000-0x00007FFEDB3C7000-memory.dmp

Download

memory/5048-247-0x00007FFED9D40000-0x00007FFEDA0E1000-memory.dmp

Download

memory/5048-547-0x00007FF7CB5A0000-0x00007FF7CB6A3000-memory.dmp

Download

memory/5048-548-0x000001DA9BD50000-0x000001DA9C6F4000-memory.dmp

Download

memory/5048-665-0x000001DA9BD50000-0x000001DA9C6F4000-memory.dmp

Download

memory/5048-802-0x00007FF7CB5A0000-0x00007FF7CB6A3000-memory.dmp

Download

memory/5048-803-0x000001DA9BD50000-0x000001DA9C6F4000-memory.dmp

Download