bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vlc.exe
Size 1021KB
Sample260822-pekddayvbz
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook profiles 1 TTPs 53 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svusfgctzkqgdb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svusfgctzkqgdb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2400	chrome.exe
1656	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4448	vlc.exe
4448	vlc.exe
4204	vlc.exe
4204	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
220	chrome.exe
220	chrome.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
1568	chrome.exe
4448	vlc.exe
4448	vlc.exe
4448	vlc.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	vlc.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	1568	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	4204	vlc.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeDebugPrivilege	1964	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 220	4448	vlc.exe	92
PID 220 wrote to memory of 1980	220	chrome.exe	93
PID 220 wrote to memory of 2900	220	chrome.exe	94
PID 220 wrote to memory of 2400	220	chrome.exe	95
PID 220 wrote to memory of 2832	220	chrome.exe	96
PID 220 wrote to memory of 4320	220	chrome.exe	97
PID 220 wrote to memory of 1656	220	chrome.exe	98
PID 220 wrote to memory of 4012	220	chrome.exe	99
PID 220 wrote to memory of 4728	220	chrome.exe	100
PID 220 wrote to memory of 1568	220	chrome.exe	101
PID 220 wrote to memory of 3076	220	chrome.exe	102
PID 220 wrote to memory of 2876	220	chrome.exe	103
PID 4448 wrote to memory of 1568	4448	vlc.exe	101
PID 4448 wrote to memory of 1568	4448	vlc.exe	101
PID 4204 wrote to memory of 1676	4204	vlc.exe	109
PID 1676 wrote to memory of 1964	1676	chrome.exe	110
PID 1676 wrote to memory of 4224	1676	chrome.exe	111
PID 1676 wrote to memory of 1656	1676	chrome.exe	112
PID 1676 wrote to memory of 868	1676	chrome.exe	113
PID 1676 wrote to memory of 2912	1676	chrome.exe	114
PID 1676 wrote to memory of 2804	1676	chrome.exe	115
PID 1676 wrote to memory of 2956	1676	chrome.exe	116
PID 1676 wrote to memory of 4660	1676	chrome.exe	117
PID 1676 wrote to memory of 1488	1676	chrome.exe	118
PID 1676 wrote to memory of 3316	1676	chrome.exe	119
PID 1676 wrote to memory of 4252	1676	chrome.exe	120
PID 4204 wrote to memory of 1964	4204	vlc.exe	110
PID 4204 wrote to memory of 1964	4204	vlc.exe	110

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4c46c728,0x7ffb4c46c734,0x7ffb4c46c740
    3⤵
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1716,i,2714550325362106196,14950685903095532850,262144 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,2325189523904929681,4266921256932204413,524288 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,2087532216386858752,14880186468551886641,524288 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
    3⤵
    PID:2832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,17677119507552739912,10601597020101006396,2097152 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,17184842836046844813,16400902226256303880,2097152 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3176,i,7597124026131456330,13491419170934823469,2097152 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3188,i,3991294198498449646,5449545372827067291,2097152 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:2
    3⤵
    PID:4728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3800,i,6587141792572338186,11863651176526304580,2097152 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --force-high-res-timeticks=disabled --metrics-shmem-handle=4108,i,11404434624194557190,12798872185421735456,524288 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
    3⤵
    PID:3076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3368,i,14633897935554610088,11586152010331143346,2097152 --field-trial-handle=1940,i,18317190233029128204,16771124079788374392,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
    3⤵
    PID:2876

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4a38c728,0x7ffb4a38c734,0x7ffb4a38c740
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1696,i,7958973963056657356,15436239550303390601,262144 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:4224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,7872736135662500648,11857869433130878967,524288 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,777849182965867979,3888765514415801531,524288 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
    3⤵
    PID:868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,14685600177445306891,8701881821108728624,2097152 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,13171880831371085843,5755472414476747699,2097152 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3312,i,14517619308170810175,8120369048159123803,2097152 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3356,i,3055658383625762287,5242926330317566951,2097152 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:2
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3912,i,8846747043166842181,992460809458908068,2097152 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4168,i,2796581039588485443,2376232568402769391,2097152 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
    3⤵
    PID:3316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rr3o43wi.xeh" --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,385861146010591065,12394357470653732783,524288 --field-trial-handle=1972,i,14077527814813190789,10521670531228995242,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:4252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Crashpad\settings.dat
Size 40B
SHA256 64498f26c8a3672f6a4bab4c12fbeed0526b4583bee8a605966622721fbfee8f
MD5 83ae6cb6760b9cb30aa1f4346d117741
SHA1 9a12f233177829d68f22f8624b3b12e8e94f8b90
SHA512 9e1124ceebb75cad72876b5834cfc3b0314eddec36b28b9a1265830075bc8fa727d14d58ab57ac7aafc1205aa3911b8ca9d7916b0cf2f94a534e05ccac2e7a4c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f3062d2948f1cd5090695d5ac95bc33dee0dcba02734943326897661f62ab6c6
MD5 077e29b6412e72b9b04b50bb1b79193a
SHA1 77dba43b4e577f0cb05139fb2e8c523b779f93d5
SHA512 443aed8ba8787ab1ec2c1ec7e058733c7dfcf866d960570f1c36acf33744396af8fec7652501a3e409ca83260e3190a8e43b5673e50019d206b40ed93a64bf13
SSDEEP 6:/FoEXEmkNE03GICOodqnsGpf9g9v+EXAYd3trf/kllgNz5d:d7XqNEsGICO3nsWf9g8Exe/gNz
TLSH
T115135E2C6E51DE37C991537CD6573F7373BAC819C661A75325F43030348DB12214D104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 13447404066b8c1439091468ffa86059d66d9b220f363b81ca450ff58a5439e9
MD5 92f0c4de24c376cf41012c01df0a1c03
SHA1 136bcc02fac101ac7824683c25f09ce03ec91da5
SHA512 f0de08f5877375710a7f581d09bafedd6d342b340b42d162c256831909c797f4fe1930f72d85b2d7a6f8051848df390ebe96af0a09fd37ea76428850f18d455e
SSDEEP 48:5plIKNYNP3zlblQ+oAM1XgmQ/7XustVkMmXsdVEPLVBKWwtl:5LIKKFhblQ2ugDrjijKVOLHKWol
TLSH
T15544A8F72C04DAD7EB18CBF46C41923CDE3282122DAAED79F17844B11151AEB31286B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 07842c06ba3e061b1223eb358bc5c496d20f5ffaf8ba1dc3248a4acf6c7f020f
MD5 36970044df0d22bc3fe4fdb11965d61e
SHA1 2f38f1206fcc33f6f8017002ffaa38b0c3b6cb8b
SHA512 63ab4c6b976cd540da06b4af623aeeef94359ed5d2f9d0ffee248971604ececab5a6e32dc1be487ccbe247d317d0563e03db823f298275271bf06d77dc217f00
SSDEEP 768:ofDPLSgcRUv+e4gUfDPLSgcRUv+/4mUfDPLSgcRUv+o4TUfDPLSgcRUv+e4f7Cg2:gXq1AfKVzd3fKEfK
TLSH
T160164BB64F24B546E685EFB0BBC9DD1C3CB033A5AC929C92E12282794AF1FC45BC115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 c56b23b1b84c76271b878c18100ec5a76e89becfd89c7fb22fbc7ee15d2a604f
MD5 6e4fa1404b7ad2a6eb7761685631980a
SHA1 ec22a05022f4d49e6e19d00636bf951e56a659b4
SHA512 0bde52de08e23c106376ae96c7eb321dd2728673433d3778aab2d3830cabf931e5b95eb185f090c5de1128761830cdbe4e1e5067e206e21eab3f9f750bce8146
SSDEEP 768:1GHkk8SFdF26RYJAACEycuvYQS0yPvkBpv8c3a0IjJVsJw:QHoKOh2fvnSlvkBpkcMrsC
TLSH
T13203F1F2A16E249FF60951D02EE6D08AFD75D0FCA513C8E49758ECD3458B1A19D2CB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Cache\Cache_Data\f_000002
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6ed86d1f41d4e1e5fbaeafed4dacbcdcbcd3b1404d6426f6ff7c4f748780bf53
MD5 2bcee8ce6fb6013e2d9a0eca0a419117
SHA1 56f9d963631f86ec9e69d98666c1ddb25c595b19
SHA512 49832049d85371c1fac33f17b82ac83c365f9df812d3e6e355df2a4bf9434c1769674c9ce8ba36022b25f861f11dc5c5802b2cf191d33ce97f5696fb20aa0e6a
SSDEEP 3:LsLllFlklNllklkXllFkCl/ollx/ncll//2NtlNlXl3Nl/l5llll/pNtlQl:LsRa3lPd/44lt+Nttlllx
TLSH
T1AC44026E53655E35D3C401FD844787517774C405DA4F9743170469316CC97545D1F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 00542c59e3e5cb1a32d1520a2bfcdc83edd146eca4ab7de4fd32506a22d09e96
MD5 25dd9d229d0771b535be572050f4ea8c
SHA1 a96cc46455ebba55f076169df2708871a948c3d3
SHA512 0d62f597a97fa60af9e69b545fa4b88cb9659dca5575abdcf1cedee24149ae0a546a61b606cf29a535f930e1bb8d51523c2de256946d2b8159d95a48d4fe30c8
TLSH
T1A9E02B81C34C0F0DD33D96F7CEF603084A0A82C43ABE3603A880C2C2335A4681248122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ba1a678059726d3e12cb698d1da373d5f860ded3abcd5cbafd7789bc264d20cf
MD5 c03b9ed6bebd6b53b65a4beda3ab6008
SHA1 86876973d019fdecd3cc641ec051b3a5f2170295
SHA512 5973f639d971cb43e3192e2388b0df9eaf91cae3513e211aab95d647ed6ac036ac48de57bbf22e80d0ca5959f66250da12ac4d66e98870f583e2642098dbf4ca
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\DawnGraphiteCache\index
Size 256KB
SHA256 4decaad5c2d3f35293d09a614b7e3210a4ceea0d08babc36a8517355fb338c58
MD5 4159f684b419d6a4f220693b398a5874
SHA1 d95f4d6d8b85b322e871d45f3d5728eeeb198794
SHA512 5266c73054ba67c6ef78c71f1ced5364e7c53e467be50a4b18c123bf219a040107aac8c68fe2cbe03ceb4196d50785126293d219adb0b765b4fceddb9deaeaf8
SSDEEP 3:LstlNllklkXlall/:LsX3lPall
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\DawnWebGPUCache\index
Size 256KB
SHA256 61cdcaf49035062b9c671450fa221043aed2758888946b8584eb6907cd1af70b
MD5 435879214fa5d6ac613c981f83054648
SHA1 5501b5c3ce06ca62245c196dbb7d4fd80a3c0030
SHA512 f9b591479f80cb1c5024064f5be29f7e0a6e036db0a547130845fc9d9d01a94a93f72db814fda9803c88c5400bf81ab91353538cb424b31ac168d4d69f80f6fc
SSDEEP 3:LstlNllklkXluNI/:LsX3lPuC
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\GPUCache\index
Size 256KB
SHA256 d8ab15dec182b83115ab4cfda095dc008eedff4dacdf26ddc076acb096523bea
MD5 bb3099c55b7e924b73f5f1e804e9920c
SHA1 7e848c50384deaf41381986820aaadebae4ff130
SHA512 0b8dcacbdd8343c6bccecec1472753d1cd631ef9323b18ea50d4cc36c2682fa234daa367ad9f6995220aba03a01651b874686b286470eed4e838222ddc8961ac
SSDEEP 3:LstlNllklkXlNSd+t:LsX3lPNSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Local Storage\leveldb\LOG
Size 279B
SHA256 410ba1609fd4217a2d954087209cf0f8d6ec9b5c6748b4b100cb149879a91d99
MD5 085f94b484ef7456a3ddf01661604932
SHA1 52fef9d490bc2766017adfd2c32373f9e61e2b21
SHA512 2d331084c84c6f47824018533306750de053c777b79ec69f143a3acff91d0e123f441c84f3cea96a27364efcb2f916cb43caba08b893074be90f2138446d507e
TLSH
T101D0C261C8ABC73A0A84C0BF9535BB5CCBB1240DAAD97B494F40E94D309A00CD790287
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServerCertificate

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\ServerCertificate
Size 20KB
SHA256 55c38a40a44105325365ebfb7615e7d38e55d7d02853c1002fa2a9ae98974140
MD5 c36580cb88a6268715ad1c3213ee3e62
SHA1 0e829bd8521137f80ac1b6fc9439c2622e3c89f8
SHA512 268e6d3593d346f2e9289d3b1505282d8bb684f4a829fecf1d807a04645a93d94f4267a50bf99df54047612023388a4afdb809781ca362581ee1e8a7826a56b4
SSDEEP 12:TLiNXB+TR0wfQQ+aoMllfIHFxOUwa5qgufTsZ75fOS:TLiZkZC6UwccI5fB
TLSH
T1D492468F9F843935E8A947B9458706E00F7AD73E8382AD6352E848503F90D8081BD45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Service Worker\Database\000003.log
Size 1KB
SHA256 ff0e43e2eb448a0f1ba58fee8e340a381e8151e95b5fdb81ee37322d59217b5a
MD5 dfbe97d1dae6df02b957766360218a3a
SHA1 8d7375adaa968ca7d50001a5c6640cfd988595e8
SHA512 49f81c9f04aa1040cec4c2a3c348b15dfd914bf4fcb0a35be20e9029549ee54c9bf626e0ebd4b7835e7e508f93e2c1f32996c2cfeb64f14fe1cec95c38c0ab7a
TLSH
T15E2149A885480469D4B849BFCDEFB5096B6DDF297FFE3717BAD5400C3D9884A1018782
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Service Worker\Database\LOG
Size 281B
SHA256 76d1e2fbafb94cb57d423d67e3d01b9970968ad0118e9e20df8642c57c52cdb9
MD5 be7831b72b0b3e8eaaac75bf84139da0
SHA1 74717788f6f38aca874c22919cc31b0beccfd93c
SHA512 ec4e6484878a044ec85633188086c2eb56be448e30420925f55faacf577b3d62e98cee176d302a60743231ff036d3f1e1bb1b49e715b0d050d4b4a6bfb61fb77
TLSH
T113D02B10D9C3D7BA0DA641AB4631971CCBD9740FD6D87B0A4F61CA8C21CB80CB2A3202
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3khbxufj.5fh\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

memory/1568-607-0x000002273B1D0000-0x000002273B2C4000-memory.dmp

Download

memory/1568-608-0x0000022722BD0000-0x0000022722C02000-memory.dmp

Download

memory/1964-803-0x0000018B7B9A0000-0x0000018B7BA94000-memory.dmp

Download

memory/1964-804-0x0000018B62EB0000-0x0000018B62EE2000-memory.dmp

Download

memory/4204-461-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-805-0x00007FF6E13A0000-0x00007FF6E14A3000-memory.dmp

Download

memory/4204-463-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-465-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-235-0x00007FFB6D7B0000-0x00007FFB6DA79000-memory.dmp

Download

memory/4204-468-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-467-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-663-0x00007FF6E13A0000-0x00007FF6E14A3000-memory.dmp

Download

memory/4204-460-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-457-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-458-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-459-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-464-0x00000261CA4A0000-0x00000261CA4B0000-memory.dmp

Download

memory/4204-236-0x00007FFB6F750000-0x00007FFB6F80E000-memory.dmp

Download

memory/4448-233-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-220-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-469-0x00000180F18D0000-0x00000180F1920000-memory.dmp

Download

memory/4448-232-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-231-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-230-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-229-0x00000180F12B0000-0x00000180F12FC000-memory.dmp

Download

memory/4448-228-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-227-0x00000180F1190000-0x00000180F1268000-memory.dmp

Download

memory/4448-226-0x00000180F1110000-0x00000180F118C000-memory.dmp

Download

memory/4448-225-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-586-0x00007FF6E13A0000-0x00007FF6E14A3000-memory.dmp

Download

memory/4448-218-0x00000180F0ED0000-0x00000180F0FA2000-memory.dmp

Download

memory/4448-217-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download

memory/4448-1-0x00007FFB6D7B0000-0x00007FFB6DA79000-memory.dmp

Download

memory/4448-2-0x00007FFB6F750000-0x00007FFB6F80E000-memory.dmp

Download

memory/4448-466-0x00000180F1530000-0x00000180F1562000-memory.dmp

Download

memory/4448-664-0x00000180F1920000-0x00000180F1932000-memory.dmp

Download

memory/4448-666-0x00007FF6E13A0000-0x00007FF6E14A3000-memory.dmp

Download

memory/4448-0-0x00000180D4D80000-0x00000180D4D81000-memory.dmp

Download

memory/4448-462-0x00000180F1420000-0x00000180F1514000-memory.dmp

Download

memory/4448-234-0x00000180D78D0000-0x00000180D78E0000-memory.dmp

Download