bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vlc.exe
Size 1021KB
Sample260822-wtbs4sswdv
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook profiles 1 TTPs 47 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svjzeggv6i44x5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svjzeggv6i44x5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
364	chrome.exe
2976	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
1288	vlc.exe
1288	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
3536	chrome.exe
3536	chrome.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
5092	vlc.exe
2152	chrome.exe
2152	chrome.exe
2152	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	vlc.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeDebugPrivilege	2152	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeDebugPrivilege	1288	vlc.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeDebugPrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3536	5092	vlc.exe	92
PID 3536 wrote to memory of 1360	3536	chrome.exe	93
PID 3536 wrote to memory of 4944	3536	chrome.exe	94
PID 3536 wrote to memory of 364	3536	chrome.exe	95
PID 3536 wrote to memory of 248	3536	chrome.exe	96
PID 3536 wrote to memory of 4288	3536	chrome.exe	97
PID 3536 wrote to memory of 4236	3536	chrome.exe	98
PID 3536 wrote to memory of 4996	3536	chrome.exe	99
PID 3536 wrote to memory of 4548	3536	chrome.exe	100
PID 3536 wrote to memory of 2152	3536	chrome.exe	101
PID 3536 wrote to memory of 4432	3536	chrome.exe	102
PID 3536 wrote to memory of 4384	3536	chrome.exe	103
PID 5092 wrote to memory of 2152	5092	vlc.exe	101
PID 5092 wrote to memory of 2152	5092	vlc.exe	101
PID 1288 wrote to memory of 4528	1288	vlc.exe	105
PID 4528 wrote to memory of 1676	4528	chrome.exe	106
PID 4528 wrote to memory of 5668	4528	chrome.exe	107
PID 4528 wrote to memory of 2976	4528	chrome.exe	108
PID 4528 wrote to memory of 3928	4528	chrome.exe	109
PID 4528 wrote to memory of 5000	4528	chrome.exe	110
PID 4528 wrote to memory of 3352	4528	chrome.exe	111
PID 4528 wrote to memory of 1124	4528	chrome.exe	112
PID 4528 wrote to memory of 1988	4528	chrome.exe	113
PID 4528 wrote to memory of 5716	4528	chrome.exe	114
PID 4528 wrote to memory of 5616	4528	chrome.exe	115
PID 4528 wrote to memory of 5032	4528	chrome.exe	116
PID 1288 wrote to memory of 4528	1288	vlc.exe	105
PID 1288 wrote to memory of 4528	1288	vlc.exe	105

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7ffd9fd9c728,0x7ffd9fd9c734,0x7ffd9fd9c740
    3⤵
    PID:1360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,16331468114570720363,12000550108799849712,262144 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,7705979665326742375,17947599243849359208,524288 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
    3⤵
    - System Time Discovery
    PID:364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,3575707983221278772,1512785501624149253,524288 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:13
    3⤵
    PID:248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2948,i,6927672797355083182,5209501449671948698,2097152 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,15659688866834601848,5606858934249169951,2097152 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3148,i,7195927265759978788,7781088969073831621,2097152 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3196,i,132707530879672181,17463337049087293014,2097152 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:9
    3⤵
    PID:4548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3856,i,3394378040244826560,377709800783013828,2097152 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:9
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4232,i,16975790318921833490,7511355718589275256,2097152 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt" --force-high-res-timeticks=disabled --metrics-shmem-handle=4320,i,15588890056815696208,17251956101439483502,524288 --field-trial-handle=1892,i,9434950659625198079,1616664063896712132,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:4384

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd9fd9c728,0x7ffd9fd9c734,0x7ffd9fd9c740
    3⤵
    PID:1676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,1855579383931632520,1864627935946201131,262144 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:5668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,15846653586175815084,7577882864859359947,524288 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,3490322605788150489,5764902154502037958,524288 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2988,i,18148975280426101505,10936221878972214021,2097152 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3012,i,5673275018762954201,8761324241893991643,2097152 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3164,i,17046790232656176122,3861443092173869793,2097152 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3212,i,8253320397572825778,15112591926215374442,2097152 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:9
    3⤵
    PID:1988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3752,i,7191205609959049675,8531925919614483623,2097152 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:9
    3⤵
    PID:5716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4260,i,10935192941207037251,1273888356108073245,2097152 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:5616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s1i21s41.slo" --force-high-res-timeticks=disabled --metrics-shmem-handle=4272,i,3569421086097701481,2811545076348145311,524288 --field-trial-handle=2084,i,1963631482272505411,12471329265019008173,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
    3⤵
    PID:5032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Crashpad\settings.dat
Size 40B
SHA256 ae59694b807824dd858cbc3a4ca4ca219d6d48850ec50c4e351d66fb4be3c8be
MD5 8387f06c1a593acf518d3694b1c40699
SHA1 12ec541969eb43f18eeffa6df3898833bb6713bd
SHA512 fea4ca880e90d6f87c56f0d42a7d3b9e90de97477f040e61bceeaa8fddcc7b8c15a642b1038026e4b978356c1b2f7f5ad7d65771dfbcc9dddd15931e8dd4ee5d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 baae01410b79fa162d2598dd3f66ff8221d12e066f96cd2a711af61d532ac944
MD5 4e7a85acf52443e1965c0238114cb6ed
SHA1 f365c679a45760e92fc6c96d393444dd35c11679
SHA512 a633ae75cc02e7f11aff18bb7c737363885223679eeb9d4514b3f32a42b5608043d795949c53909e0407c400c411273c1bcc3aacec5a10ea9f2c8f1e2b01c780
SSDEEP 6:/FoEXEQjIltN+txDgSGg/bmElwwOvwkEXMkahvmkllcFpnJ:d7XL0N4g02wkElqvr/WJ
TLSH
T12A13176EB6A11A02E6C6103C4A8F2BF3833860188D45830340F57424284F3300C2B02A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 a5f96897c5be551fc7ab07acaad5a05cc347afede697937809c403f04a33054e
MD5 328e1b5a0ed2f42b85d5a4951e83ee60
SHA1 084d5a51623a3b2020216fd4ef3092f73070ffa1
SHA512 6246edb6177aa226276cf1ff7d5ac009a0d705e32538e90450447643d53a031a0169e871a19811b5d7db2460da992b3b1b8f2e8eca88bb84d93ddb67baa7e981
SSDEEP 48:WlUEYrP3zlblX+3dAM1XgmQ/7XbOrMmXsdVEPLVBKWwtl:iUxbhblXNugDrqrjKVOLHKWol
TLSH
T14E4496F72D04DAC7EB19CBF45C45923C8D3296262CAAFDB9F17884B10151AF731286B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 a15526c4b5bbedee090420485e97e56cd836c4ed7ccc7bdbcb6add5d70922d1f
MD5 a3834dd2773c0b16a65d08fb4eb6a921
SHA1 50af4df31ed7684663a9cf6baaff213a6508c6e6
SHA512 8d4dddd7d51203d395501ec931168dfddc0f4c73e29d317aa837c96049efbfa0d1c03acffa102b12498a4baa13eed5fe07261eaedac80006b7b6f985ddbead12
SSDEEP 768:9UfDPLSgcRUv+s4LfDPLSgcRUv+i4RUfDPLSgcRUv+T4QUfDPLSgcRUv+H4a7pgy:Ua2zmfKVzdGfKRfK
TLSH
T1BE164BB64F24B546EA85EF70BBC9DD1C2CB033A5AC929C92F12282794AF1FC50BC115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 783d509eb49659f12e058e26d3905cc78029a7a6d75a9290b14eabb50bcfe1da
MD5 a9509e230eb519ba9ab9285e5aa11d42
SHA1 785ead82815f70a81e164e141f6197d2a34ae2b0
SHA512 75b1f3e954399e9a214bb6a2d299f0821ce47a8aa83652b20ab021ac324effbe1542b940e1d8c378b96447ac49b7b040fbf09ba3c9bf20d13bdc112dab658fca
SSDEEP 768:0xzB4nhHRDDD+tYto4GPVk37/lP0BwXuiCjonV2JdioSg6CRzsCH5hnMGf:EzBixDH+0o45r/VVVCjonVmFP75pj
TLSH
T10103F1EA79B0A8D7F690B1CBBA3F4527BD16A25B19D809C838330EDC5141C6C0CAF579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Cache\Cache_Data\f_000002
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Cache\Cache_Data\index
Size 256KB
SHA256 54b2a4f032d9f78623d343962bf045513e4d490eedc3c4e62890c4481825b13d
MD5 5e32fbea4a8d175566ed8161f7020ff0
SHA1 a65255eb7cd707f3e06c4835513fa1b063c12fb6
SHA512 54e4e8f58eb837a48bb379c5cf37d76477463c7367b56b3298e4cc6592c28ad497132968bfb49a6b4126f82d77533cff6be34d56bed673b2b0ff1ac0f2b2b3e0
SSDEEP 3:LsLllFlklNllklkXlL2ltlollLll/ncll//ZNtlmNtl3Nl/l5llll/wlNlXl:LsRa3lPCtl4ilthkNHtlll
TLSH
T14344026E93955E55C2D401FDC44757916374D505DA8FD743170426213CC17901D0F154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 7bf3e52e0a38e23e44673742e2e99cb57621864553e8fc8f191779927ca4ffca
MD5 96b292231cf3c780d37d6203f23b65e2
SHA1 2c589a95d83d34c6306ed67ad5b26470ee46f4e9
SHA512 2e74bfd7d68c7322aa1b0ab3d4536f54a980fd913e32cba1bf35cf52a83b2f9442f2789eb4527772d3a33bcca780da77012947c480123df8d6fc79a446560f7d
TLSH
T18BE02B81828C0F0DD32D96F7CDF703048A0B42C429BE3603A880C6C233524241258123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 270b27798889ab87a90b814a040483946b4535732fd5a36a423bd4b1f8cb146d
MD5 1fe5b47354eaf4185ab6ad0334157e30
SHA1 af724d0df5ef23721fdca2ad25ba2e92bdbde2ab
SHA512 66b819a88d4bdba7da9f4af797692383e01489cbf0d19066c857e79c4276637d6116c0f59f1c478252f5dea60893fc357e854666c367a5efd971d14ea2f9e4e8
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\DawnGraphiteCache\index
Size 256KB
SHA256 2ef009ae8c0c0988ec4e73403ac7f0bd2ec0a9699b00920f29eff27098fa925a
MD5 351f78467758458581891ce7f8c92ad1
SHA1 72d6aecb655e0da470b145b25fdc57fd3026f776
SHA512 1349974cb8f117230e082f8ae21fad17981ff86a6e542ac5a7ee5043fea9b3de9f63f545dc2a9f7885ad19df57a47170bd006e4c76b45279ab63de2c23b801de
SSDEEP 3:LstlNllklkXle+lll:LsX3lPeal
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\DawnWebGPUCache\index
Size 256KB
SHA256 9bc3417f22b0ea2145aa73d5efd212c8322ccd42a6b1bd1fbee54423c54e4456
MD5 d69c4287f03617ae36c0d9e22627c823
SHA1 0e164d70f9fb54937e2ddb8f6a816dd90f2be2b6
SHA512 83f4c7cebf9a4c48546d59718e21d5f464985506c68f2c278a7d7df793f7b916ffb12669adf2aac2d7cb77031a98c2e24168d55ca34809688bd98571af4d5d8b
SSDEEP 3:LstlNllklkXlLpeZItl:LsX3lPdRt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\GPUCache\index
Size 256KB
SHA256 fd457a1a789d58d85db349f7a25c84e690e2d38482dc31ce8525e571f1799e7e
MD5 86dd286045934e31b29d2dbadc61619c
SHA1 7743d97198b65eb8c132a5cc576b797a188a40e7
SHA512 d12012e358ea1db1a987dffb634adae608eedccd7187bd0cdfcc9b47e08c6e417488d30a24da32116eb83c5a7b73bf5a21947cb7c17dc08f9213260754b5e68c
SSDEEP 3:LstlNllklkXlKejKllll:LsX3lPh+ll
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b0da86bbf2e097fecceeb6bfb2262f27644addf62e3778a3a861185cb5bdaa45
MD5 6cd83e18e2fa83cb1af20901e31da86a
SHA1 6d038687de5eaa55a43a9c588f93b87f2103b800
SHA512 355a77a2e6310877208cfd48cabf96183036d2a0baf9740f211db0ebf4495cdae0156789cb68f29312af94818087aeb0ea49b73cc39cf60d034866cafa8764c7
TLSH
T1B8A002111380C120C54002F1290A838E6A81F9378000121376D013468C611609911149
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 ea4ee9c401a30b0d5cfb965989039fcff1909bc4a9e40849cda8202e38746ba2
MD5 658257986fc93d00fb9a9b7c7f7cc11f
SHA1 171068ea1da22f595dd76d76720813fb7cbebec7
SHA512 56140db1570715ee44d69dd43c426eeb0159c3876188a53c98f352605c997e635be6b146011437854abaa677c74c343bd2f980d8522b28fd6e53c3e369651afe
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fvvjn3ml.frt\GraphiteDawnCache\index
Size 256KB
SHA256 9e5bd9ae5026747ee488d79e4f3a9d62d0b188b2ab8684ba5f09fb2e50305616
MD5 36e8ebaf33afce7f1d83bb048a9d51f3
SHA1 f10eba5772c10dc40c856edd43bce551fc1c3f78
SHA512 213ad1e93c564d861b9b43344514350ec148ae8ae0d4adc1e7fd64cd7f0e350348b7f0038ea1c4e3ae2e05c6f4838c633fd21c34e2f5534531435a5874ab5145
SSDEEP 3:LstlNllklkXlqIll:LsX3lPqIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 4B
SHA256 9228457e41924897f745f14432dccc5083ab45ed3621d13d67f1581cc1bc85af
MD5 d3b4db01fe9ae00b74af246e3996d27a
SHA1 e7dac68197722d8f5e7e65c6e63fa8ce60623234
SHA512 d8452ef305229d657dab52cd3c3908592e3bb47961c1a1b5ed2e35e6b2630d9382f05d67069a8942d6d0477314d51e578e0cb4f19824b2ac5408aa1d48fde57d
MD5 SHA1 SHA512

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

memory/1288-207-0x00007FFDC5390000-0x00007FFDC5731000-memory.dmp

Download

memory/1288-720-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/1288-719-0x00007FF795C10000-0x00007FF795D13000-memory.dmp

Download

memory/1288-233-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/1288-491-0x00007FF795C10000-0x00007FF795D13000-memory.dmp

Download

memory/1288-208-0x00007FFDC6590000-0x00007FFDC6657000-memory.dmp

Download

memory/1288-496-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/1288-206-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/1288-205-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/2152-519-0x0000021B23700000-0x0000021B237F4000-memory.dmp

Download

memory/2152-520-0x0000021B0B040000-0x0000021B0B072000-memory.dmp

Download

memory/4528-717-0x0000024BF1E50000-0x0000024BF1F44000-memory.dmp

Download

memory/4528-718-0x0000024BF1F50000-0x0000024BF1F82000-memory.dmp

Download

memory/5092-0-0x0000025A9A2B0000-0x0000025A9A2B1000-memory.dmp

Download

memory/5092-183-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-380-0x0000025AB64D0000-0x0000025AB6520000-memory.dmp

Download

memory/5092-195-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-193-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-197-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-194-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-191-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-192-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-188-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-196-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-204-0x0000025AB6300000-0x0000025AB634C000-memory.dmp

Download

memory/5092-493-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-190-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-203-0x0000025AB62D0000-0x0000025AB6302000-memory.dmp

Download

memory/5092-202-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-189-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-187-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-186-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-185-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-184-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-379-0x00007FF795C10000-0x00007FF795D13000-memory.dmp

Download

memory/5092-182-0x0000025AB5EA0000-0x0000025AB5F68000-memory.dmp

Download

memory/5092-176-0x0000025AB5DA0000-0x0000025AB5E42000-memory.dmp

Download

memory/5092-175-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-171-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-170-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-169-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-13-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-33-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-6-0x00007FFDC6590000-0x00007FFDC6657000-memory.dmp

Download

memory/5092-5-0x00007FFDC5390000-0x00007FFDC5731000-memory.dmp

Download

memory/5092-4-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-3-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-2-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-1-0x00007FFDB73A6000-0x00007FFDB73A7000-memory.dmp

Download

memory/5092-577-0x0000025AB6480000-0x0000025AB6492000-memory.dmp

Download

memory/5092-579-0x00007FF795C10000-0x00007FF795D13000-memory.dmp

Download

memory/5092-580-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-201-0x0000025AB60B0000-0x0000025AB60B6000-memory.dmp

Download

memory/5092-200-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-199-0x00007FFDB7370000-0x00007FFDB74DF000-memory.dmp

Download

memory/5092-198-0x0000025AB61D0000-0x0000025AB62C4000-memory.dmp

Download