eed6af3a88f047260861300d9e5dd8dd3c084aca6a230d3f29496e0fcdb27869

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vare.js
Size 87KB
Sample260903-snwdsaaa87
SHA256 eed6af3a88f047260861300d9e5dd8dd3c084aca6a230d3f29496e0fcdb27869
MD5 fcba71d77cf7b17fcfff091d99a2e568
SHA1 cfe9b35f4a1319592beb4156bb78c558a58873b4
SHA512 b4740c1df6ddf9477b0e6174abfbad4d6c53b0d6ee7c2e1e24bec52b2b2ba72156617458ad1cbf8bdf6120a2f385cd3f70dd8f3a2d61936401f7d618a5c357a9
SSDEEP 1536:XXap+pX2+WAl7kFpTxOFUUrG7mS04WRQXap2pX2+007PDG:HekX2+HCTxmli7i4iAecX2+0
TLSH
T1E593E71978968633937573E9BD63BC06F405B2A313C845073A3CE1845FBEB18B594EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
122	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1524	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329223837786316"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4944	4836	chrome.exe	103
PID 4836 wrote to memory of 1524	4836	chrome.exe	104
PID 4836 wrote to memory of 4932	4836	chrome.exe	105
PID 4836 wrote to memory of 4932	4836	chrome.exe	105
PID 4836 wrote to memory of 4876	4836	chrome.exe	106
PID 4836 wrote to memory of 4876	4836	chrome.exe	106
PID 4836 wrote to memory of 3892	4836	chrome.exe	108
PID 4836 wrote to memory of 3892	4836	chrome.exe	108
PID 4836 wrote to memory of 4232	4836	chrome.exe	109
PID 4836 wrote to memory of 4232	4836	chrome.exe	109
PID 4836 wrote to memory of 3264	4836	chrome.exe	110
PID 4836 wrote to memory of 3264	4836	chrome.exe	110
PID 4836 wrote to memory of 4536	4836	chrome.exe	111
PID 4836 wrote to memory of 4536	4836	chrome.exe	111
PID 4836 wrote to memory of 1920	4836	chrome.exe	112
PID 4836 wrote to memory of 884	4836	chrome.exe	116
PID 4836 wrote to memory of 884	4836	chrome.exe	116
PID 4836 wrote to memory of 1536	4836	chrome.exe	117
PID 4836 wrote to memory of 1536	4836	chrome.exe	117
PID 4836 wrote to memory of 3224	4836	chrome.exe	118
PID 4836 wrote to memory of 3224	4836	chrome.exe	118
PID 4836 wrote to memory of 4576	4836	chrome.exe	119
PID 4836 wrote to memory of 1740	4836	chrome.exe	120
PID 4836 wrote to memory of 3976	4836	chrome.exe	121
PID 4836 wrote to memory of 4560	4836	chrome.exe	122

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\vare.js
1⤵
PID:4388

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffad6e2c728,0x7ffad6e2c734,0x7ffad6e2c740
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,11187808647481014678,16882941705382145023,524288 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,10004640331953824080,6000155438210831981,262144 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,726092566266430740,6053887889504314151,524288 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,15274241032025042543,11463654485764353648,2097152 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,16678346710180296647,8893765858890210814,2097152 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,17457158037453209227,4823681435391268236,2097152 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:2
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,4890802109007404580,14030465404457672227,2097152 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,10426440973453020195,16636282648791620318,524288 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,9931130129478969410,17969598579314882434,2097152 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4448,i,5178734087407207805,11843311605402150598,2097152 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3572,i,689919307955950977,13043143228243717653,2097152 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,16156021777250866003,4436657918341111265,524288 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,4468358577129325437,6683173361566099998,524288 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,6875535957559547989,12073938801065248048,524288 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,5645388011553921205,1815774865636488859,524288 --field-trial-handle=2036,i,67698595272790116,9787642231524933332,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:4560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c15c774a34fa216f0db1fd17795dc2fed0485fbf9704faf530a2691e6c7935ce
MD5 87cf8a900b3c6cc137c5274354ce638a
SHA1 5be9cb9e4650c0dbfc1c23cccacb16db299c8050
SHA512 413b40c44dcbaf084d5b860685783fad3b0315f3c5bee214e3d937e6a019e8c791e71438035137a689234bf7f76dadf8bb86156b736b13dc6b0dfe8f83758608
TLSH
T149E02B96C921AC3729FE471850914B46EB6553562A80895F3A3CC20C4FB063A4186C9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 344KB
SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
MD5 a76556d1143eac7869c5cdd2ba75aee7
SHA1 62ace25f7a400460ef1550bd536b8006aff57655
SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
TLSH
T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3b71ee6c4b329a635727a99e05d55c1dc99b63d37d0dd14bc683c0f40afa12df
MD5 ec1122b4106947f6b479d9dc6957000f
SHA1 dd16c8942e5d3db2d8049737891920fbbb85298c
SHA512 b93521e8ef55a39d4e2a2265e082e797e9f1af7287cbc9482cee673c83b963d544f1032590a48d2f3f9807626a1f6db5d503193afa67ab6da11026b1228fd755
SSDEEP 192:/QRscBzCL2kd7u5qMxZyv7hpAPRp2tZKbv95Hsb+WNHkofvnE+gqI2Rk8Pja8sYB:4Rsmz85dE1Ze9UXprwXMR2G87aodvV
TLSH
T1D452B52FF8102D7B9DDBC229FA127B1BD7F6646125901E84EAFC89AC15E75CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 47818cee2d84ff0d8fddf4ba61d3af8659f7c7ad1884b5497b5a886631365519
MD5 e48008d9f3e01a51b304f76fa15ffefa
SHA1 f225a0231e992308a635060d2cc79959ee5aff16
SHA512 55a32ecabf4060a70d7b0e503c91c0bdf4ce44c1ed2e5878fe489fad92981debb9cd74307482c1c2fda2688bd73a58b550f4d7f71eb2f686d959fedb5d110231
SSDEEP 192:/QRMeL2kd7u5qMxZNv7hpAPRp2H6c95Hsb+WNnof4gqI2ak8Pja8sYZbVyIsnAU/:4RMI5dE1Zt9UXerw0T2z87aod8
TLSH
T13952E81EF9106D3B5DC7C219FA22771BD7F6146525A02E84E7FC89AC14E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 559359f2287879bdafb9abad17a9b6e2a6518f4e22af6b1afe7acc2c924cfc1f
MD5 6b3690c3694418aa46cda50e7d8bf006
SHA1 069ba3cd11015f397740b89b3f57db1a7d97611f
SHA512 0f9f337a0a7e95ca0eda34be63bbf7225079b2a78376e0744291c4fb6e44540ac6063c6996a454363816d9a727ea2687c6e22bfb16251ef7b6dee40e80a37fc6
SSDEEP 192:/QRscBzeL2kd7u5qMxZNv7hpAPRp2tZKbv95Hsb+WNHkof4gqI2ak8Pja8sYZbVz:4RsmzI5dE1Zt9UXprwXT2z87aod5V
TLSH
T1D152C61EF9102D3B9DCBC219FA22771BD7F6246525A01E84EBFC89AC19E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1e8714fb6fb8cbb1d10f9e65a8429322c8a61f14f32708b75f46a918e18eadd3
MD5 aaf1620623a63d5a847f97eeb299f5cb
SHA1 894728962031e803836f9ed827f15cc77bc6d555
SHA512 23c50877a36ee36cd444b55acca0aaf959043a1aad7a476ad5dffc0dd45688caf5a1a6f760a4155fb3289470685335f5ec8dbcee4fc46b61e2517aa531a1f728
TLSH
T1A9B0125180016141C40702F46142548871259F20960A1B0143F0A96788256528025474
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0428.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0428.TMP
Size 96B
SHA256 614e83eb91761a6fdff1acb3acac6e25503fb0ff585014a4c3dd81f18e57d0cd
MD5 b114b60d662dc50a4f5818aeb72d75d8
SHA1 a38bfbdea1f5b17fb22de3b96f2c739c09097d84
SHA512 1698b303d8b9592b6c4422c70511d212143b122a06cf1a2453d2e626447aa59c716e74cd1c6b29536c8ef82bd4fc6a3354de1eb5a3d3fa044443817ab8a86b8a
TLSH
T18FB02200C2A2B202C80A2FB02A8880C83030CF22C3033202C2E02A2AECA02200823220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 d2710aa598eb1ac74997b09011d09ab4937ccede34b2986a0b3315288ac03f55
MD5 8f1973545fd9f98aca2d251e2ceca107
SHA1 0dca00d1985cc4d2d9f682e06082de5283e47aae
SHA512 0ede118f180d64febc4cdb12c4057e1a9449f84394ce53db368f770369d96538efebd553584cef699aa95b437a237feb282f59ed1cd5c5e42ccf07be81b04e9a
TLSH
T150B02450C0100101C103333DF4C3DD4037151F1403130303715CC1C0DC117014315141
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 25f11459b79c7d23eac5f4aa44424e77338ff125e3651f42dcb29d7958dbb8b3
MD5 14385c65c7ff4b91f3583854583eee76
SHA1 d71322ea12c2e59eb862b8f0c632221402461134
SHA512 91ac11127943055011761791eaeb47f12a70fe884560581402d68bb5979a6f00391baa47aeba61eb171080d2357d366b5e58310b6f1178df12d53fd0fd9461ac
SSDEEP 1536:6YyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:/qfd7NtZL8cHQRZEQ6Sps9
TLSH
T1DCC30237EBC21E335D82CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 88a536db061a0e2ee9eb786e84b0f666d544c29df25ddc884ba7c7a5c34689b4
MD5 86f83d34587e03a70673905611a34965
SHA1 79d3a3d6c94ab984b93a9413f69eec78e4571d05
SHA512 56f7e496f5982518bf067c2ca980cae031c4029766c0bc736319f927d4b04e74142a1c091425a880ea31768b50a70d04f964963df993160cbec80e58b214cee2
SSDEEP 6144:uvSoFSdIxUBB/UJCbbYZZUxDqZ/ZLW3Ext:uaQSexUBB/tlpqZ/piQt
TLSH
T1E2342232DF576D334E8EDE7820230D9F97F149A5A425D314CA643BD728A3916A285CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 da6ee7bd723eed2d0b8d429cd7caecf11c42f5aef1c36bd01ec3a3a6a142395d
MD5 527af05a3e30725c2581856b5bec2737
SHA1 d786bba438f33c970b5cdc4fff3964f888ec8337
SHA512 2c0bdc90fa1f85fca819ffa0954dc9af33710bce9f63e2113d4231b71c9d90063485d08972b0d2441bd4e871332f8b19a074655dc7dcae45d1445c63d777336a
SSDEEP 6144:hvSoFSdIxUBB/UJCbbYZZUxDqZ/ZLW3Ext:haQSexUBB/tlpqZ/piQt
TLSH
T147342232DF576D334E8EDE7820230D9F97F149A5A425D324CA643BD728A3916A285CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vare-Stealer-main.zip.crdownload

Path C:\Users\Admin\Downloads\Vare-Stealer-main.zip.crdownload
Size 124KB
SHA256 c60b71a69f2ad0099ed4aa40a3ceb6d0e4637431de8743a6fad0ecbb4a1907f3
MD5 102359c8b71a24aa48f338011f82fd40
SHA1 df67753c8eb6981b8502654d5dc94849ba1dc73f
SHA512 83ccc52c9b7e63190e8d74a4cc136be768195c82f5e01cbd8b92d076b16fe66ce8ab8cf3efcd8e8353e76a82cbddf94b25ba202e5a82bcf4746cc85edf509d46
SSDEEP 3072:yC2Un7BMQEX5e2FKikX1Ky1f8hUuXbfHKbCOe6SA884bJI/CbuBKU:5eQJ2FFkX1oCqLHKZe6SAWbJIKoKU
TLSH
T170C3122F2F7A5841D5843C6B07C52D276AD8C1C618DEA886FC7D7C6A0AC2393653A03E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download