3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9

Resubmissions

20/06/2026, 04:46

260620-fefwhsds3r8

20/06/2026, 04:40

20/06/2026, 04:37

20/06/2026, 04:34

20/06/2026, 04:30

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM (4).exe
Size 4.9MB
Sample260620-e8ygzsc19p
SHA256 3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9
MD5 7d1daf13865d725090511e79c480cccd
SHA1 f33b007f3df5f1ba949ecedf5645fd10f83d36ce
SHA512 e8e1ebcbf1d9065a01089e833b6dcfccbeaf435a80370ea042f633571b1879a1f31269e3244453fde6851a1c38d5594be670d76a48e57abca3a5e0d67ee27408
SSDEEP 49152:nOjPWFZwclTLDHWk7o1HMvdCuYTfksFHaciUylf00Ki482X/ub2PwTAK7BJQmDfz:JXnLouYTB7N8vyO7UqGGyL6bs3U0mD
TLSH
T1FE369D5663A401E8C1B7D178CA978627EBB27C151331DBDB02A0666A1F37BE16F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1232	GameBarPresenceWriter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	CitizenFX.exe.new

Deletes itself 1 IoCs

pid	Process
924	CitizenFX.exe.new

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
924	CitizenFX.exe.new
2364	FiveM (4).exe
2740	FiveM.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3668	chrome.exe
540	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Colors	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Colors	FiveM (4).exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264039278534610"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{790CF285-47FA-46E4-B9A5-E047DA9E393E}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{79169B39-B355-4C04-AFBE-27FFC3152591}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
924	CitizenFX.exe.new
924	CitizenFX.exe.new
2364	FiveM (4).exe
2364	FiveM (4).exe
2740	FiveM.exe
2740	FiveM.exe
3844	chrome.exe
3844	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
924	CitizenFX.exe.new

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe
Token: SeShutdownPrivilege	3844	chrome.exe
Token: SeCreatePagefilePrivilege	3844	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2748	FiveM (4).exe
2740	FiveM.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
3844	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2748	FiveM (4).exe
2740	FiveM.exe
1396	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 924	2748	FiveM (4).exe	87
PID 924 wrote to memory of 2364	924	CitizenFX.exe.new	89
PID 2364 wrote to memory of 2740	2364	FiveM (4).exe	90
PID 3844 wrote to memory of 5064	3844	chrome.exe	109
PID 3844 wrote to memory of 4408	3844	chrome.exe	110
PID 3844 wrote to memory of 4408	3844	chrome.exe	110
PID 3844 wrote to memory of 540	3844	chrome.exe	111
PID 3844 wrote to memory of 4120	3844	chrome.exe	113
PID 3844 wrote to memory of 4120	3844	chrome.exe	113
PID 3844 wrote to memory of 4400	3844	chrome.exe	114
PID 3844 wrote to memory of 1128	3844	chrome.exe	115
PID 3844 wrote to memory of 4400	3844	chrome.exe	114
PID 3844 wrote to memory of 1128	3844	chrome.exe	115
PID 3844 wrote to memory of 2096	3844	chrome.exe	116
PID 3844 wrote to memory of 2096	3844	chrome.exe	116
PID 3844 wrote to memory of 2472	3844	chrome.exe	117
PID 3844 wrote to memory of 2472	3844	chrome.exe	117
PID 3844 wrote to memory of 1584	3844	chrome.exe	119
PID 3844 wrote to memory of 1584	3844	chrome.exe	119
PID 3844 wrote to memory of 964	3844	chrome.exe	120
PID 3844 wrote to memory of 964	3844	chrome.exe	120
PID 3844 wrote to memory of 5044	3844	chrome.exe	121
PID 3844 wrote to memory of 2392	3844	chrome.exe	122
PID 3844 wrote to memory of 2392	3844	chrome.exe	122
PID 3844 wrote to memory of 2068	3844	chrome.exe	124
PID 3844 wrote to memory of 2068	3844	chrome.exe	124
PID 3844 wrote to memory of 4540	3844	chrome.exe	125
PID 3844 wrote to memory of 4540	3844	chrome.exe	125
PID 3844 wrote to memory of 3476	3844	chrome.exe	126
PID 3844 wrote to memory of 3476	3844	chrome.exe	126
PID 3844 wrote to memory of 3648	3844	chrome.exe	127
PID 3844 wrote to memory of 3648	3844	chrome.exe	127
PID 3844 wrote to memory of 2244	3844	chrome.exe	128
PID 3844 wrote to memory of 2244	3844	chrome.exe	128
PID 3844 wrote to memory of 3848	3844	chrome.exe	129
PID 3844 wrote to memory of 3848	3844	chrome.exe	129
PID 3844 wrote to memory of 1512	3844	chrome.exe	130
PID 3844 wrote to memory of 1512	3844	chrome.exe	130
PID 3844 wrote to memory of 1932	3844	chrome.exe	131
PID 3844 wrote to memory of 1932	3844	chrome.exe	131
PID 3844 wrote to memory of 1432	3844	chrome.exe	132
PID 3844 wrote to memory of 1432	3844	chrome.exe	132
PID 3844 wrote to memory of 4720	3844	chrome.exe	133
PID 3844 wrote to memory of 3476	3844	chrome.exe	134
PID 3844 wrote to memory of 4268	3844	chrome.exe	135
PID 3844 wrote to memory of 780	3844	chrome.exe	136
PID 3844 wrote to memory of 780	3844	chrome.exe	136
PID 3844 wrote to memory of 888	3844	chrome.exe	137
PID 3844 wrote to memory of 888	3844	chrome.exe	137
PID 3844 wrote to memory of 2356	3844	chrome.exe	138
PID 3844 wrote to memory of 2356	3844	chrome.exe	138
PID 2372 wrote to memory of 4248	2372	chrome.exe	140
PID 2372 wrote to memory of 3668	2372	chrome.exe	141
PID 2372 wrote to memory of 1768	2372	chrome.exe	142
PID 2372 wrote to memory of 1768	2372	chrome.exe	142
PID 2372 wrote to memory of 4592	2372	chrome.exe	143
PID 2372 wrote to memory of 4592	2372	chrome.exe	143
PID 2372 wrote to memory of 2208	2372	chrome.exe	144
PID 2372 wrote to memory of 2208	2372	chrome.exe	144
PID 2372 wrote to memory of 4980	2372	chrome.exe	145
PID 2372 wrote to memory of 4980	2372	chrome.exe	145
PID 2372 wrote to memory of 3228	2372	chrome.exe	147
PID 2372 wrote to memory of 3228	2372	chrome.exe	147
PID 2372 wrote to memory of 4500	2372	chrome.exe	148

C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe
"C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
1⤵
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
  CitizenFX.exe.new -bootstrap "C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe
    "C:\Users\Admin\AppData\Local\Temp\FiveM (4).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2740

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:1232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa08a8c728,0x7ffa08a8c734,0x7ffa08a8c740
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,2430628284306790137,10107614900161091965,262144 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,2476951503831956684,2286191198115649504,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,9027929513980989212,12266210403169920870,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,15746838383047334624,9334919135763202062,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,15386840276797272185,5069293470365385311,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,5743943153611587335,14713230054907555853,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,10745206381258180706,1992401215727659096,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,8502111672996897608,15538728333170043888,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,14497314944883388206,18175335891453805331,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,2683546698461895900,15155640536210845989,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,8437544335643922269,15159865317997644565,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,2325508529682050270,4242600059310779404,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,12580217820708773294,5853520641095246654,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5512,i,14986236173874910036,2233711912267514704,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5556,i,8626947450118031422,6705347512154804839,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5376,i,2957503822552122808,9456961765344372104,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5996,i,7955712361613756736,7280335364704139742,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3172,i,13332717816085758664,11760387149344327380,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6408,i,8336072306851682538,15845165535657955858,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3324,i,6723263968046710484,17749186971167649149,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,11095262577363785161,8685604214215703148,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,6904262445470754884,12952225012397865862,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,9511363276898569410,4759981141985253067,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6096,i,12004908461657644012,15257868529915162954,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6560,i,10297890160779128997,9378209132477607654,2097152 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,6455227286822049914,6282674356220797255,524288 --field-trial-handle=2080,i,14220789852684337993,9847957707355974276,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:2356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa08a8c728,0x7ffa08a8c734,0x7ffa08a8c740
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,6511044114590862691,9855942930417029163,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,13943279358151361600,8824467537046687360,262144 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,10556826623282113715,4318597120897539308,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,616670053650179163,4896837864804564634,2097152 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,2355598000346420136,6091249088827518381,2097152 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4472,i,11435229139770862848,6794433944267493033,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,18063188004989449848,8970471822692372247,2097152 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,9843718075962829598,18234180131589765712,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,15791594721854416989,9672264225281613397,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5312,i,8739289553415438166,70615723393625342,2097152 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4700,i,16540712692344108944,10658053356730935416,2097152 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3232,i,1929797527902571422,10897068152478375900,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3412,i,10856732611108874531,11709890033723918980,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,11380147957719881437,17934154909919354423,524288 --field-trial-handle=1980,i,13130349277750646527,13786804325426601795,262144 --variations-seed-version=20260618-170054.182000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2607de90f2293e5dc2145f6fcd437367df06b92c4cbd1178a397aeb171104cc7
MD5 79378c146f4914f6234384b7eac7b9c4
SHA1 c322f25f1eed4cacf423af69f92ef8925dd9a767
SHA512 244c38de19e19e6192d713fff9b9bdaeccc164f4339325c09055650b4d82894c3b77b392bcbc565f9d2c22ab1e325b03719962a3d6397b8271b54314cda6c45f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e2bab2a6e5710a25ba81b4ee5df63beebf1ac5827de3540e6ded5643848dded2
MD5 8ec909b1f5d729c94727ecdf0181c572
SHA1 10e1949d84b6934f8d2b1b8a8c7d86034fc90c6e
SHA512 b58e266445ad0d07987a26f224f6fb0612bc1571c621a050c10a3d5594278250311aebd1649bf83d496b4e28c364599460603785cfbd8534d392603313136430
TLSH
T113E02BBACA65EC2B18FE5758A0558746E611135F2F40594B7A3C860C8FF0B3E968AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ee4f4b95453fbe356cb7fdb6aea2adaaba298853cc8e528c651c57b12b35c40c
MD5 5e8a55f7b03c7ce09d375ec16e6b5509
SHA1 550527ce0b95c267a024368afa1a062eaec83399
SHA512 fbde62874e0c9c1b8264d13bf822453c5364d52d0c711c6eec50e9a2371c8bc99914d1442d21098dbc30c10ea2b9dc3ca499fcc0fda286de02bb0e0bea902294
TLSH
T19071915059710E76D36AC4FAE0E79926BF30A3CB9C07DE1A74D834B56842398E1DE43B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cf1ed6d5512074b2df9fe79600e098213126fc3764abb35325d01e5545a634bf
MD5 32335d565e0e61c3303ebd7dcadcfe22
SHA1 603c35dcf4f748082d47c93e1c57b70019cfe308
SHA512 8d5d7e5787f76400742dcc7a1aed6320253813a2c7b9b102bbd057658a4e0cbe5b895df560c693c553112308fdcaaa55e4a0e480778ec96b4588595c931cc373
TLSH
T1FA51E8400030017DD716D8FAE1E7E1E93F3095DA9D27EF9324EB38B6B841398A1520F8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 0abea84712f1bdc301310452121eca765f5b69830f7a1d32f43676b83cdff413
MD5 8fc1778e0fc10c75cec3e69a671444c1
SHA1 5909fd1585479a481ffcd9af9e7269e5e274196c
SHA512 fe25774698d162eee77983cda1aae53eb5ea2046419a300d3f96cc75af0928cb0af44662893b87469fa9bf45f66216e77ed0e4bcfb42a4899ada6fd015f4d4aa
SSDEEP 3:MsEllllkEthXllkl2zEklOkNt:/M/xT02znO2
TLSH
T1954404057FD00C05DD00D0F0C011C3500770D5100511D743357137337CC55400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 24KB
SHA256 0909786cb2655db0457d0ba23d00b1686b7cbb7ba47abce5f0d78ca04d01056e
MD5 33d8c56c06bdcc10c71ebdf43719f2a8
SHA1 331388adab57a84e08954d0b744a2ab635fba3ad
SHA512 f45548dba3488801b681fb54888292fdd2efda02c3a33ca3308889049adee12a96e4b298fc6566f73486858ca4772ccac1d139a9bc6df4773e20644f6ed2069b
SSDEEP 96:neBCP7Gd4ym6gFOJsUYlTC9kad2bybsq1pW4EM0j:ncJeyRmtUoTCVIIhEM0j
TLSH
T138B2F8EB5A31708ACF452DBF558D78B6CF3B912CDFD1EC98B0310411E8B865682A64BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 67c386f7f47f3ddb3c9780d157c4bb9e9babc3aad7419dbba9b49dacc04a8c47
MD5 25c5fa43dbea703590798cffb92cf307
SHA1 5fb38621450951c3c73144c302704b9fd97286d5
SHA512 25c142443359c210f1d7a20879396c291d325f8b7fc0ba79e853102019c7d4c75624586db9c5797eba3c138f13a652ac80024b06f1c390e149432db455034356
SSDEEP 24:dAsf1ERJGGuUhLr/xkCdl15V6Y9vdfPbkEl1CTohRtd1/XAm6UW:Hic8rJkADjkRoD
TLSH
T18813AF3C8B725553F7A8C5F4D59B1F706370E3E429D2DA59A97DB0582C09C827A03358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b408d5a731d84e417235215c9e28cd4adbdfc5b8b69abcb903f7cbb3c875b369
MD5 d66076a64a2084b7a6301592ebbc2954
SHA1 99916725d949eceb13e76db59a3a25091def1b1f
SHA512 8407c5214d13a65ded7dfd7f74ce6ba509891d6039871c9cb6f4f08c78e5a5a1d5147006a3f6d2398e6efc66198cd8a72104a77529b2d1b66b188ff8e319c86a
SSDEEP 48:cVSHVMYVhVoHVBxXVjVCNVdJVbEV8yVGoVMiyV8+VRfdqVtR1Vf2VCAVihV+WV:we5rRirJxZ
TLSH
T14744C21B34A40CC6F85AC9F2F6322DA9DE3CD3D8E6839E5353101324A9B147D8FCA994
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
Size 1.0MB
SHA256 bb3fd3e33f137f7a14bb006fb6c404c613391b2dd30889235e5556f83b1be916
MD5 827c241b270dc3404f48258c80d92660
SHA1 39eba5f621abe3f1e0d3a7c2d6c569955efe8355
SHA512 108ae83db89a9a9b33dc2d106ceef075ddc685cfe576604101bebb9c0df02f301c56102d8131b9ba0caeb82536f1affe30502ae835c6e6f5351c8f4b15e1395e
SSDEEP 384:p+/TzNtqM5/uY/x63Gv1EyesfQWv1EyesfQFRvxH8RvxH02A3z0t3bxP:6NtR5H/QQDQwDQFtZ8tZ02s0j
TLSH
T1A825C1F8BC744CFCF954123663EDC2955D88AEBFDBC365A660E510D4205213716472E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3
Size 4.0MB
SHA256 95f3eec45f45df279ad1c1b6b848033ea634d0c65e6a60613c742be448024f38
MD5 beff2fdcc1184a12b80a7cfcdcc3150e
SHA1 73e5bef3ef1c7739e3e86306d01f641f1f3800ff
SHA512 c0b26cf316deba35d6b99b753f24013f2b5cbafc35a7928b6f555998bf387925ef4403d3e35887c83ec05ffb4b24ca17a5b920adefb1e03b8d1ed9dfaf22f54f
SSDEEP 1536:QgxAJMiMm9ioS4cBtr81b+Yj6MmIZTKs/oYLFGDmG3B/tg2o:Q+Ag19iH6Mm+yDPEX
TLSH
T1AA16022170E02807E6FDCA7CBA9D11AD1DB02AE54A7BF28F8778586B644824E1DD35C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 3abc1a0841b0be09345624fe91427029a91299b3996476d39e27055c3403dc06
MD5 e9d40a690f140188558edfab6ea58288
SHA1 b1396ae95f471e23aa91bcffbf477f75ed47fb3d
SHA512 55589b2cbe730611cbcb533514b7a917b7b7644083f3ae03573343cafdab2e7e73ff92c2c6b2197047d04eab3c929291039cef81c8537c5505c0f4bdd0ace42c
SSDEEP 192:JL4vkwEjcXR/tH+bF+UI3iWGVZWNkqp3Ww:JL4vREC/tIkUI3ijVZWNkqpmw
TLSH
T1E1F330AF5F703201CEBDA176A8D704E7997DF03F8B5369C55C7108A4CEE2612A15D0AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5b0a72d1597c8e4f30db6b19f11e9bc74c4b21b8964e6bf3d418c54ebee727e5
MD5 ac1949300aa34c35405688bb86b7fc13
SHA1 be1ecbf587d0d1d97af2f9d5dfa3331d86766f72
SHA512 61a44ebcb6d5efef9f095ce7fc8aba3a3446a8e6281896a571f995d7b5a7f673b4d4e8b105d40af756846f6156a827f0e22b524cf584e99155805a46f598e189
TLSH
T19C719CF383E5856D991156F0AB14BE2FCE2D0A24431D3C6989E4AF4BA3E2872D20174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9c9c416af777ae1ef68d7cb6b59faf3dd2e28c405239fb9aa53462ac5f21a1d2
MD5 c5aa7a151b723a01aee07d421cb1471b
SHA1 a353800e9e4d340fa11f55cd06d70f23bf53fce8
SHA512 2e07a9a17590e5dad9b78e5b18ade2b959bbad9d61c9a839e4d9562d1e0201b53b6e0f73420ab2ce5cc7ed07a4ede7192802210d8eb20344ade984860adce7bd
TLSH
T1352148DB9B79745B207E8DAA1D547C162CBAA83501505DF8DB9AC16CE0D44E30F110A6
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6c4d337b791e5b319247a77973a5f1a8fa5e77d7b53d289bb108d6bc6c8c79da
MD5 ca7ab8ab4264d51a7e176bfe27efc783
SHA1 24922606166973e5dad9999a1becc070e3bf21b2
SHA512 68c64f19fd08e969cca0fb1e23e370b54c967dc7a63af94f0627dac1bdaa485d092f55ef5b19aadc6bc6cd329d4de0965e35fef9beff7aebe8e0efb9ee2eaaa2
SSDEEP 192:ErRCCHZov72vAPRp299THsb+WNnR/0Jkw8DckwSqd+VyIsnAUge:0RCC50C6XuFwh0uw8Dc72e
TLSH
T1DA42D86FAA14257B9CDBD21AF9617B57D7F6103135D42E84EAFC892C15E79CC222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 439b61011b326dc82218c2b79a0aa0a7941cd0f966eff63148d9dbf37755100e
MD5 fd60f2839f6fe4d60279497c063f4e96
SHA1 61a80bb383bd006c44064a987285d813fe69dc2b
SHA512 71a6aec8f895471efd20143e57af931b7998c7da128e468804cbc70626a702b4470560aad79756c47ac89f4e45570d4d021b2da3918ec643705c10cd3e5be76f
SSDEEP 192:FRCCHiAev72sAPRp2id/f9THO7b+WNcm3UVbwWQkw8DckwSqCzVyIsnAUgraJ:FRCCCAaCNXLFcESWpw8DcoVe
TLSH
T1A552D96FA950257B9DDBD21AF9217727D7F2203179D41E84EAFC8A2C15E79CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fa647103bc1f32cd1ec215b971b7032b4c7d8c5931eb2567f58a60d34e0e26c5
MD5 249d2f1a02b1579654b38ab22003777a
SHA1 03c6ff009a5bacd3a22e6e32e4ca39206096ea90
SHA512 c1c7d5ce2a7032bb89bd36183cb99e5565d05d65737a3428281703b5d7f2371bd1a1f3a479a899b92bc55b625dd97f69db7a0920c76395388eb72d519d077a15
SSDEEP 192:ErRCCHOov72vAPRp2Y/P9THO7b+WNnUqYrx2Akw8DckwSqC+VyIsnAUgE:0RCCu0C6X7FcxK2Zw8Dco2E
TLSH
T18D42C86FA914257B9DDBD21AF9617767E7F1103179D42E80E6FC8A2C15E79CC222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c40ed6630b4876bd6d4d599959ed2fe0a02ec062afb0d84a63e6a3e9cf30af1d
MD5 51c08084f737f494493c5ffb254fbf76
SHA1 03d5340375a2c0a7cb683991272877c9650c1639
SHA512 9755d9f4f5d32c2eedd3958ee3209892d2cedc6fb233deb8fd033e00e6cefe394fe8eea55b02b32c471c4176aadb3305bf5604e6142b97807594f66ba0473b21
SSDEEP 192:ErRCCHOov72vAPRp2id/a9THO7b+WNcmUqYrx2Hkw8DckwSqC1PyIsnAUgE:0RCCu0C6XuFcRK2Ew8DcoBE
TLSH
T16B52C86FA950257B9DDBD21AF9217767E7F1103179D01E84EAFC8A2C15E79CC222300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 02b1cc7a5de904a0ea6465f763a958ef80ddd1f4011fabd478e54af530dbd0ad
MD5 3fecdd0cbfe079989b99384b95d75299
SHA1 d92243ec58a96733a273393304af4f54ab7dfdcc
SHA512 097a672cc9bd6d175b37f98dc386eb5e2ef376829daa74330dbfeac63f644b2abe9c9e33905a2b760b5b7363382eb2acef1c7a4434eea2d42d5e063678b1c74a
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3hLHGMIB3Whm6KoU6:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOH1
TLSH
T10452E967688D963F0FD8D68CDC267F4FADB101566664082897FB9C08039A7CB115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 a7ba99f95df5e0c14075d825ae26796a7e4ddfa59850d104198f9df4c81ece40
MD5 25d9595405e64bcbf8fc1f8708c840cd
SHA1 89fa53a6289ca91e099463552d20298ad506fb0a
SHA512 2bdd67f3add4955b4d09a796fc01c3806fe930cb38b8552c78f04ee2e27a0e075f98b754f6eac6690eadaf61d591cda077ce937ebc3fe2844a9fce76ed4fe096
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3hLHGNIB3WhmGKoUa:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHi
TLSH
T16E52E967688D963F0FD8D68CDC16BF4FADB1019666640C2896FB5C0803997CB115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 4e5469f4e3a607668e53dc4f378d3cff7e11312797369ce05a3ce1c2e2d81e95
MD5 03b19eda48d54d06ff634e19423ec2f2
SHA1 c8764347954c0883d94844f1b658ef073a5e75d1
SHA512 4c06983901c7e4216f670f191434a72cd8a0196465c94077e8493a8b80f3db94125d131ba7c4b6d75d9a797414ff419d9081ee4b415a08189b2b4bc5804b074b
TLSH
T1EDE02CA029ECEBFFA269D2030A28932CD6F4740AD3CE38461F04C84812C6E08F2E2240
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13426403971156229

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13426403971156229
Size 7KB
SHA256 594e55e4a9a1d287034deaa46937267543bd04ed4fd825d0f0fa5b33fdb92dd5
MD5 fa2482375ebdfc7520940dcc5d9ece68
SHA1 098c92c93386cbf54a55da69b5438118f2f0b6c6
SHA512 62beb61db5f2650c2e4d55b3e43be56297f207806ed47698f59388f7242e6926586e9bd7eebde6c5697fcb5b415c65a21c64a0b32bcf1bd9a5840717b6d60e9b
SSDEEP 96:39qDytTldo5WJSLU3yErkuOJZofkJKtOgcOTVOw:39WytT89LU136Qpn
TLSH
T1B5F1CC956AF4043EF7BF5A7C94F900F16F36B94279E1CE1E40A0521C08627819F75F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 ed8cfac4f0bd46451917c4b6f0120b659bd3820ad4f6d72221664f4222246845
MD5 c11859e23828ce21ad36a51f5be4b0de
SHA1 1613b81443349a681d8a1c3df511a84063e47d79
SHA512 0aa1e3205d1753d5835cb8e0e15a092d527b2a04f07ff311e6fc926404d9614315c2bc9c9f32ae3c36e6c6b3a3cc644d17fbf715ae67f144c61b2c15103c7ee4
TLSH
T181C08C143700A2A3ECC509B949840B408B94A803AA20E417886B8F545F06D662FC0B91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 962fe5cf6d6f7663a93a0ca24e5b14bae2d828ea49dd49b399888e23a1118a6f
MD5 df6a9354ae9185909b0b248f9251626c
SHA1 df26f2f23733cb4ea2a7f7f70a8e8843233747cc
SHA512 011f240c4acbad7886956961f737a8eb524cda18c754bc8ff37cd57dd2200cfd1feaa4f9d3e9a17c5f45b10202615849d3254c64c376571e11fae1203404c6cd
TLSH
T16BE0DFB42AEDCB7F5195A09B5A20E32C86F17408E7EE64166B04B88863CAA04F2C2240
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 338341601a30b3a5f0e500af13e63d0ad05425b88364ee32811da9dcf4c8093c
MD5 40293170ea6116c95ac8e54bf3849dbf
SHA1 b4ca08d5417e14cc4ff3a00c2acd26956e046c0c
SHA512 e1864f8cb179ccef4c011828e74bd238685c10eb14b35c693e37dd551d285e3e618827608782ce0b8d7842330ad3773b7b5a4a7eb31270e54f5d789440a655e9
TLSH
T194A0021145D10411CD10C7F861755542375388155D52C303D4D20448DA5B1C75395570
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7c22ea06cc709563e5c71499140d4c87dd1482103469e2136591d028bccce399
MD5 cbc68be21536b82f8f6ea69ea7ed9a4b
SHA1 2dea1dcf27f1154543c690d76590fa0eb4e57e09
SHA512 175f3aeb1107957d08f8b48c276f14ac39b7833db869d28d99cb28ac332aa09b643eeb423b699a49352fdc5bfece5bd70bf91d7d48d7377ac8a0c582dab1085b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a279e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a279e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 9ea7f33505f537b0e9726464a09c45674091eaa8685d3a9463cadb3c00b2847c
MD5 3597d95f11e04af426d65c900d758209
SHA1 fde28b21fc0e662bc2b1a496dbff7d4d25752c13
SHA512 1639f3649626be1f3a7d93e3a04e07bf2d82dfb6dd87ef6f8871b0258d593e80562069da989e66ace9b924612f27609ceb6cd852f3744359f5f5809c8213a74d
TLSH
T1CDE02670B9ECC3BE4150C05342A0A32CC7F1B80C93DB354B6708588872C0224B2E1290
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 1993d3793729e612dfa0c2de7d4bc75610b995a76f79f6e8deeb4f6845cf21c2
MD5 bdc3a0c5911b0db1d4ae837938c7e668
SHA1 d5966ff84235a433aa5c07088eaecf36e38b5a3b
SHA512 13dff15d867098c5610d395c9ded577f61f09ae042a81132b498c678932619c1105889d641843fdaf2debcff0cc9ba38642ebb153effdcc197749d2e65a82697
SSDEEP 6144:ffpsLiqC6IPHXi0X6vK+1+m7Rkm1tYpBeh2BAoD:HpsNC6cHy0IFZ9oBGcAoD
TLSH
T16D341227AD69DEF715A8E719B08E0B1F0DF449A39470D997D8F66F00239AAC6010ED78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 cffb271aa64f93513fd578ccde8fba07582b78dcabf9e5fa8cce6b9b59581995
MD5 7380bafd0c3ee6ba2616dd63505b8756
SHA1 b14d8e8d9700b09fa1a034602b5037c43c02bd14
SHA512 68c69ffff7a8f35d5b615ed1c0316bf36d2ddf1f9395cb0447386a67a3f0229cbd37e1633f75c06133b7b01e72252548e902e9ad1bad585136c9054de802ac2f
SSDEEP 6144:PdpsLiqC6IPHXi0X6vK+1+m7Rkm1tYpBeh2BAoD:FpsNC6cHy0IFZ9oBGcAoD
TLSH
T1A8341227AD69DEF715E8E719B08E0B1F0DF449A39470D997D8F66F00239AAC6010ED78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ae4fb7cbc0908280808a64abc729f0533d0021cdb015b72b0a342e4dc4b40e46
MD5 7fb774fd807b27ca32180f241f4c50dc
SHA1 3149cfdcfd92fc8ecd30a13b7bd722615edc650e
SHA512 294de8e3087f8f0319d8f00c7c230d1f160a1d6c9567d52aa43e7d5ea65f9b244df23bf0cf5aedecb434ddb3fec7f4035862fa95de83a92793ccb15f12e51b84
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Jm7Rkm1tYpBeh2BAom
TLSH
T1C5C3123B5E74A9765979AB4EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 9fa25c596e22d43687460285d2fef24622542f5bc0f743cc491cdc7d5c457084
MD5 be61f26f624ce240a3c41b81d7dd91dd
SHA1 7f7330c2d74bcdaf39a459e41123a4007bac34dc
SHA512 e2dbd453bf50b5fe1d5b177bc64dbc256747f547881b7bdbf75dcc17145e2574f2b1a0c44983e4828f313dd3be87534e20707768242efb01fc22fb04bf7c0695
SSDEEP 3072:MDpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBU:MDpsLiqC6IPHXi0X6vK+1G
TLSH
T121C31256F86A8FE711D8D614B1AE1B0F8CBC4583A0E0E95BE4F37F41124B992411FD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 2b6b8c1562c739ba4cc937056af323bf6d35c592ebd17eac6f1d753af9676ecd
MD5 5f63278774e573252987168b0bd63973
SHA1 8ec99a6bc9b1e2881cd4158f7aa539cdac97f35b
SHA512 fc2f8e69d1e8535bbb61eb64e35d336c912b4b2a9aefd6d25492c335761e7d2818f2b3c63f461a60eb9b9fe3f847748d6c6cd020f959210e62047eff5659f19f
SSDEEP 3:MsEllllkEthXllkl2zEklMsZt:/M/xT02znM4
TLSH
T1EE44040C7FF43405C5405070D011C3500370D7510D11D753745514137DC57400C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 4cbcbe5c4ea04d807d598ac4ea21fa9e0f2917f9d3725b4783538717077bd281
MD5 1e4e40c3e82dedf526afffcf173d954c
SHA1 d70ea3f319c9f3212e3d94b671ba47b90ee1bbfd
SHA512 16b2c6e54ca8c658af16294193fdc9945e6afe3303b5b2b3dfa6b196ee865e3d510e7aab665cd916977f28c2288e161cfd6d34474c44b0e8e2416f5dde69279e
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JH:TkkhCU2QB2zbBxxOhttzGu0mM
TLSH
T1AF23D08E2B6821C9D591183EFEE34CA1797D0F1CCA2BA9D204E00C794CD24EE656F1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CitizenFX.exe.new

Path C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
Size 4.9MB
SHA256 98a9cdad08a5fb7db4ac8e12064a731f522b037f7778c1341800301986e602a3
MD5 95a7769478acbe78cdba4debd8936406
SHA1 714142bf753165d0318b799900aa6c00afa682e6
SHA512 ca60a785b7baa5ff0f38bf274799afc2755df9ac61163dacc15f31b6ba61d20d0b4d0f48e87ab84d79592786aabd9b09235e0df6aaab74f3d3d0e81da8cc3c8f
SSDEEP 49152:fOjPWkBEGgHRtHhFAgI60X/i3klpPVVgqxdSA+tDNzDksQPBJTehAazOtFwaW40u:WpUJI6klpPVnSAnCabJ8JhOJp3pGWme
TLSH
T17D369D2663A401E8C5B7D178CA978627E7B2BC051371D7DF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_785195508\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

f6fc4bca-6250-4b1b-9c7f-f913d42b90c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_785195508\f6fc4bca-6250-4b1b-9c7f-f913d42b90c3.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 c2a392e97407c85f27f907fd166d41a3eb5b63ab71e2b5fd2638717530bdedc9
MD5 0bec15ac63c27afbe2ebcd36eb92e042
SHA1 4ba84e58f95e2501ec5e6f61e2552eb6094f2219
SHA512 0e5966d07ff7dd5032c8fef71b4c89d259bbde6f9e1dda0c1f92768c8844a6225f554c283ea33fe96687591dbf76c0dd7a4390444b702fe14114f78d627bcb06
TLSH
T165415D0798EE4F20E2FAC031AAB7632293317CA5E320AB0E508043C81D52E4258E6F4F
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download