Analysis
- user interaction
yes - max time kernel
270s - max time network
271s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PhasmoCheatV Injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
PhasmoCheatV Injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target PhasmoCheatV Injector.exe
- Size 84KB
- Sample260731-c8ad2svsdw
- SHA256 41feb63c1bfbefc246b5183f7f336d441b9e6538b53b13e9c81e45f1576fd33d
- MD5 09135656baace7477e4c60f4fb3ea2c3
- SHA1 984f99d45f6c50e960143ea66424c5958e263e20
- SHA512 c7d4635f701b7cfc9abd2f4090ce90a054db4d227bae27cd0d56d67e440763f7664377f780127ce48f4d6d8ed72052e9cae211c3ea8ae9a8a20f9162edfa7c4d
- SSDEEP 1536:ke7TRtIxXzII9Q98J1q5nbXtmhpayGAUvXGB5SiFzl0tExeQOBDFxnMbs1wSCRmR:5wxn9Q98J1q5nbXtmhJfUvXGbvFzl0Fc
- TLSH T16483F126F7BA48C5D53B727C42F70605D6B2BD062B259BCF1BA2D04E1F9A2F0A533641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 148 camo.githubusercontent.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2268 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299394891683960" chrome.exe - Modifies registry class 39 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff PhasmoCheatV Injector.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" PhasmoCheatV Injector.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ PhasmoCheatV Injector.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" PhasmoCheatV Injector.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU PhasmoCheatV Injector.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 PhasmoCheatV Injector.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} PhasmoCheatV Injector.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings PhasmoCheatV Injector.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 PhasmoCheatV Injector.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" PhasmoCheatV Injector.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg PhasmoCheatV Injector.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" PhasmoCheatV Injector.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff PhasmoCheatV Injector.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3256 chrome.exe 3256 chrome.exe 4652 PhasmoCheatV Injector.exe 4652 PhasmoCheatV Injector.exe 2728 PhasmoCheatV Injector.exe 2728 PhasmoCheatV Injector.exe 4720 PhasmoCheatV Injector.exe 4720 PhasmoCheatV Injector.exe 2356 PhasmoCheatV Injector.exe 2356 PhasmoCheatV Injector.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe Token: SeShutdownPrivilege 3420 chrome.exe Token: SeCreatePagefilePrivilege 3420 chrome.exe - Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe - Suspicious use of SendNotifyMessage 47 IoCs
pid Process 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 3420 chrome.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe 4712 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4728 PhasmoCheatV Injector.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3420 wrote to memory of 5768 3420 chrome.exe 100 PID 3420 wrote to memory of 3588 3420 chrome.exe 101 PID 3420 wrote to memory of 3588 3420 chrome.exe 101 PID 3420 wrote to memory of 2268 3420 chrome.exe 102 PID 3420 wrote to memory of 1972 3420 chrome.exe 103 PID 3420 wrote to memory of 1972 3420 chrome.exe 103 PID 3420 wrote to memory of 4368 3420 chrome.exe 105 PID 3420 wrote to memory of 6028 3420 chrome.exe 106 PID 3420 wrote to memory of 4368 3420 chrome.exe 105 PID 3420 wrote to memory of 6028 3420 chrome.exe 106 PID 3420 wrote to memory of 3004 3420 chrome.exe 107 PID 3420 wrote to memory of 3004 3420 chrome.exe 107 PID 3420 wrote to memory of 2300 3420 chrome.exe 108 PID 3420 wrote to memory of 2300 3420 chrome.exe 108 PID 3420 wrote to memory of 2052 3420 chrome.exe 109 PID 3420 wrote to memory of 3928 3420 chrome.exe 111 PID 3420 wrote to memory of 3928 3420 chrome.exe 111 PID 3420 wrote to memory of 4028 3420 chrome.exe 115 PID 3420 wrote to memory of 1368 3420 chrome.exe 116 PID 3420 wrote to memory of 2404 3420 chrome.exe 117 PID 3420 wrote to memory of 5288 3420 chrome.exe 123 PID 3420 wrote to memory of 5288 3420 chrome.exe 123 PID 3420 wrote to memory of 3696 3420 chrome.exe 124 PID 3420 wrote to memory of 3696 3420 chrome.exe 124 PID 3420 wrote to memory of 5160 3420 chrome.exe 125 PID 3420 wrote to memory of 5160 3420 chrome.exe 125 PID 3420 wrote to memory of 3256 3420 chrome.exe 127 PID 3420 wrote to memory of 1232 3420 chrome.exe 128 PID 3420 wrote to memory of 2428 3420 chrome.exe 141 PID 3420 wrote to memory of 2428 3420 chrome.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\PhasmoCheatV Injector.exe"C:\Users\Admin\AppData\Local\Temp\PhasmoCheatV Injector.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff97a74c728,0x7ff97a74c734,0x7ff97a74c7402⤵PID:5768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,10969858128278373602,13903399964420305632,262144 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,18288327452003916894,15903422253734770413,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:32⤵
- System Time Discovery
PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,2814190605342986638,7205205456738319765,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:82⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,9336227706006029359,181866520035260220,2097152 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,8048599277147968147,3143216695465518001,2097152 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:6028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,11458047880273137171,16409784381831691325,2097152 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:22⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,5269315614172553850,7493019134034827578,2097152 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,2276297021361785122,6668710980920017547,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:82⤵PID:2052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5820,i,1628820129044730790,11071146477499550280,2097152 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:12⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,3528101942508409226,236574360105436043,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:82⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,5322630050481467010,14915490148442188346,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3564 /prefetch:82⤵PID:1368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3536,i,12964567799647753623,14852458909601748351,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:82⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5612,i,7762051673216679793,3956918605175703978,2097152 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5524,i,14700823107364054079,12793840484850814514,2097152 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:12⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,9352012398244656626,15528061139313590344,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:82⤵PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5844,i,5608453823039301087,6514287593626562058,262144 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,15905927564594055020,336303915711765172,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:82⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,4124549778688000411,7024036793380783048,524288 --field-trial-handle=2112,i,5192270639502471745,7286380848478799186,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:82⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5172
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5304
-
C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"1⤵PID:5436
-
C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"C:\Users\Admin\Desktop\PhasmoCheatV Injector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e8195b03f66ccf900110f71ee7ed3b052a8ea43a2f093ef09ccf633e3966753d
- MD5 f5d099b45aa73a40824287f5c201b216
- SHA1 64a28a2119e8a0e612d5607294fffaf79b232864
- SHA512 3765cd1782e233df05e37b6d03bd28d764a96574199be0a333ab3e40f677811ae051ae4131c8e995a187619f47e5471cb1cb88c245870bf43632f7eca51b781e
- TLSH T198E02BAEC972EC3708FD075DA0900746E65453573B80445B3E3D8A198F7463E435AC5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
- Size 331KB
- SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
- MD5 05ef8155cf66131654d3bb9c9cba5853
- SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
- SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
- SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
- TLSH T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 46a4f878ba90b3b26d53c2b908c1b20f540a637a9e9dced6d9e0e2f84fd9cb8a
- MD5 11a9847678d37b6c1a5bee7771a847f8
- SHA1 0c86fbd8389e599401eba9a78c098db848d740b9
- SHA512 b132c459f578ac360c799f56da8f73227c45b3e4906e65e235e749ad66ea9d85943fe0e62c966410d15436d569ef7aea7c3e04089ed50612b8ddf805f72f7154
- TLSH T1E4C0921AC18520A5CB2885F1056B280B21A62AB4266257AAD1B2AD9A8A626B65602D1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 377dcd68468c23c08c64ceed4dec7784d14f7705bd1b1e590dca82c66a14c68d
- MD5 f5308e87fc34674750b740f37fd9aff8
- SHA1 982da86f7ed809d06f3ea88a9520778660776fe4
- SHA512 96f57783081e6509379448f1d58918b8ad9a97e9cb173e5c8ccc7caaf722f1e4574a5deb63ac503cdafb824597d8ea7bdafdb3a2bb42edf526f0aa6da7b4e9da
- SSDEEP 96:Dn9Nly9cyxD0PiLG2NjNnq1MQ8zecQonrEV:ly97Nnq+hssr2
- TLSH T18AC1E74A4FE282D4E796D53010D7001B717C675A35BB0ED88ADF45326B6136F2293A9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 6d9286f34881f93bb60c480cd4a8abfdc1b0e8bb41085ba729cea59de37cd914
- MD5 a4e27637038843d607adc046e2230b4d
- SHA1 ed97cba5b9a74c6a9205a20da7588c9995867843
- SHA512 23578d499745693d4489e58bead4a23df553914fc041bde9f168c89bf6d8c9dc9a9ffc92a76143ff000073e0f12650fd49ec4f052772b3789b146b0ba2939981
- TLSH T13F71AEF3C3D8C52D994156F4D721BE2FCD290A28532C3D66C8E4AE5B53E2872D21578E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 273d076ff63ae8156f122cc1e74635d8b1f73159b23af5945b5269c482a46de1
- MD5 67444c11f08c2ab859345f7630cd5844
- SHA1 ee10a0562adfbd8f81114b7c24420fa2e9600f5c
- SHA512 0cf0cebf7cf8cb7c0db389af2e44257f86a914c78b8ffeecb6faf68d810376cfc924ec3dbc4dd1b6ef864264f1a381342368b79c96fa2cf59599bd4c3b436e44
- SSDEEP 192:DxOa73mOmJ+EaaLy9U0BvAs/bmlmmmYmDLjhnmzmlK:DxOa73mOmJ+EaaLy9U0BvAs/bmlmmmYR
- TLSH T17FD19EF7C3E5952DDA4156F4EB15BE1BCE290A24431C3C6688E4BE4B93E3872D21174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 bd83930e89d1258a4be78a5010f1a8d1cde31b701172e17e3ef15d4dd75a995b
- MD5 f3e709779b626631c9337535668c4e06
- SHA1 38608ea816e1ada03e98979ac558589a34d502a1
- SHA512 393f04be8edc235460a8e4ba12ffe7bd2cc3c3a2e28c8309a927cda2214190388ec61006fa32b3a15cacea4f99df7f24b7acf5e13f1ae73084240f62d6607270
- TLSH T1C371AEF3C3D8C52D994156F4D721BE2FCD290A28532C3D66C8E4AE5B53E2872D21578E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 e12b3c66c976a79072c5aa4c25eb4f72ca1f3aaf3936277cf7409ba1f9a99741
- MD5 9cb6eaa9f4f4a507dda417d88cf895ae
- SHA1 18b2367d2ac29a03caa50657e2d45e5a2d50e14b
- SHA512 63b24dba8fd073b4d19318eb09a2686a6cd383e6e52be820dddf0dffd2c8570e67c9dbd80d4d41bb114cbedde0b82acf1835c73e4d8691cbe1ab7b53b2e906eb
- SSDEEP 96:DxOa73mOmRaaLc39U0BvOaoqtmLmDmtmrmgmOZ:DxOa73mOmRaaLy9U0BvOaoqtmLmDmtm7
- TLSH T166C17EF7C3E5952D9A4156F4EB15BE1BCE290A24431C3C66C8E4BE4B93E3872E21174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 d567c55dd7d74c016490e37fee34d8aeb8386bc1c397ef330cfda4ba045ce34b
- MD5 817c9f9c3ccc20f1004f054401e46ce1
- SHA1 88187103f20b283de5d5e86f0787de5b3d12b97f
- SHA512 05ca7a8eefcf0fb001c96944e065cd86c4e4de59ee0f6b8aead7ea1f5fc9fa4c61c20a55203d4b8e45465f8de78e19ee0a65212de921e25f9d53c15b7181840a
- SSDEEP 192:IRE36SX1QsVsfv71hp5PRpdXyaL192Hsb+WNXIXwhILI00w3cXYMOEd/a9gRmNVK:IRE336BhLXxQwP2/rcXPatbe
- TLSH T18262F72FA92069BBACD7D62EF9157717E3F0102166E41E84EBFC8A1D14D76CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 cdd8b3225f3a5a89bdb8e3c1ecf5128c6877246177c0c9b74e466f54058af178
- MD5 c97f19d1f721c2a6873da4bea9c2c664
- SHA1 882ec7ad936396334fd8d72a2d44f1c07d54b754
- SHA512 df9bacc607911f5fe943390b075a9d265bae67e6fbf9fc36bfd7525cc804aeb7cac87f76a2b9b749aaf2c1d98b6830760ccdd6bc6d163a8c6347b94fb463dc7f
- SSDEEP 192:IR5TPSX1Qs7sfv71hp5PRpdFe192Hsb+WNnwh7w3cwMOEd/a9gRmNVyIsnAUgraJ:IR5TU6BhLXqQwcUcXatbe
- TLSH T1D752E62FA92069BB6CD7D61AFD257717E7F0102162E42E84EBFC8A1C14D75CC222751B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f4a41c1353be59ac101787db0659b084180c057e52b5f3ffa133ac634f01d443
- MD5 db056c07f2930ac4f09338f3aaed5265
- SHA1 82083de7ab860ffb7fd842bb78e6fbd7265f29d1
- SHA512 63dc8573d03dce81bfe7c3c7698039e3952dad132161a5017e94c07f5d87d81b8b6bf4622171e5da1d8a5cab5da19be34a3bf5cd188ce19e42f3bbf63a29eecf
- SSDEEP 192:IR5TPSX1Qs73v71hpAPRp2Fe192Hsb+WNnwh7YZ2UEd/a9gR2VyIsnAUgtaJ:IR5TUfBhUXBQwcA2xah8
- TLSH T11C52E62FA92069BB6CCBD21AFD257717E7F5102561E82E84EAFC8A1C14D75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 4deca561b1d38bd47e5ab957e31b78338053b90b4458b87011c4cd3657d7411a
- MD5 5a00dd8bae3f26de1752a814babc6a6b
- SHA1 c1de2e84f914f97767d4e2463fbc53764d111cfe
- SHA512 f66b015b93bfa15630fa8c2fbfdce87324d5f75db03541dbd1fd5e74c0e9a6e6584d016bf8d93f613e388a5f07521ad20b90d0a57884502db3308e537eb36b4b
- SSDEEP 192:IR5TPSX1Qs7dv71hpAPRp2Fe192Hsb+WNnwh71qYw1Ed/a9gRKNVyIsnAUgraJ:IR5TUdBhUXBQwc8YZajbe
- TLSH T1EE52E62FA92069BB6CCBD61AFD267717E7F1102561E42E84EAFCCA1C14D75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 8944d482ed043c4bff164f1de4ef1229476f72e8e633a2a9755504ba5ea0c49d
- MD5 ec0a630904e88db7f76f8a970993486e
- SHA1 6caba202a9a7125ac2286df7e14a97448dc59ea3
- SHA512 1ac43e9b847fd812b9f3e1ef975f9605b1551d4091fdaf11c8d8930d493ddb1201630c0db64968acbe4170bf2a44e159148fd525c3efa31e3ddf200ced1e17da
- SSDEEP 192:IR5TPSX1QsVsfv71hp5PRpdXyav192Hsb+WNXIXwhIjo+w3cZMOEd/a9gRmNVyI6:IR5Tu6BhLXtQwPTVcgatbe
- TLSH T10462F76FA92069BB9CD7D62AF9157717E3F0102162E41E84EBFCCA1C14D76CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 5c580a77e9ea490b1d2ccacf56f782746a781862108f0607a1d5243e797574d9
- MD5 46ac208bbcf0121fc193fd9e35684753
- SHA1 21ea45275a030b949289efee12262cb5ca5e2091
- SHA512 36625702582170ea2252b4981bff61ece676a92213a5708eb45bab1a5fc52ca08f1ace06de8d24805008306abdaa4a88723802928c6a53ac50b5e2bcd69fe5a0
- TLSH T163B01241C0435201C70603F41146948871149F11D71B170143F06D36C8292508115051
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592c85.TMP
- Size 96B
- SHA256 72737d2d75b3d2c8b1c77a4709f20c15ac095c5d725d54071759a558c0861717
- MD5 912e5bbde3caefa98056e4ad8ea3e06e
- SHA1 c7c0bf172daded77a87034d412e18d4ac2f3b6f5
- SHA512 b552a5dc214e35bfb51b04da9de4a1d10052af45665c523a9c7ad21b44c54d90f042fb51a4c620cc97555932fcadd2b0016209458ca8a4139e0b1991afa684f0
- TLSH T1C9B00255C107B612C0421BB02EEAD6D97365DF39C6071716A2E22E7ADC397605539960
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 0966a3354a1a61f239d1755c0d19fd644ac681adab57a9815b47731df484b3bc
- MD5 cf935a0f5d9cacb4182b66bd92ce6b5a
- SHA1 5c77150f3f3ccb3e069c8bd672ebfc272269f3da
- SHA512 d49937a1ce3c13a9c4936e7f1f7c0f6002de08bbec495cfbe8a7c8eeafb1b845a44303c46fec935d4d3f1a50f095a6dfec30ab6188e620a833075348fa24cbf3
- SSDEEP 6144:rqrmDy4irM4HqHHsm7Rkm1tYpBeh2BAoh:6maYDHHf9oBGcAoh
- TLSH T1FC3413765D316CAA4E76EE1F308E0A1A1FF14EE3DA65ADD185D48B0C234DACC1F4AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 3264c91779990d5d989f9639957a15b966ae4359b16e22f84b5bc3323849f559
- MD5 e2dadef7ceb6c5678fef5ba3cc34c265
- SHA1 c71d5c26f613c41a04c18e02f4db9ea30b5a6613
- SHA512 46a6b0a5b3b5ccfc2d6eaf45f37875b013404ff34fad2aa426ee0840b3c9ccf817767c974d6390ec7f0cf7b058dfa520132a4c595cca67f118927f8699bf35be
- SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:rm7Rkm1tYpBeh2BAo3
- TLSH T154C3122B5E71A9375979BB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 7dbcc88ba3b947b355bbe2185132bb3ce73caa07a4ce6f3050825c65a0ad65fe
- MD5 43cceeb20b6b7adb470eee81bb270877
- SHA1 8c7e42afd4a1ddf76efc686db412256981105468
- SHA512 fe0a3aa22a5b24592e67ed4d8be1c1069cd22d5e8e76ac170ed228fcebeddf4880305f61ec78a41455429ac3c427873db19a5a5ae9c3dee785dce5fade920d10
- SSDEEP 6144:xqrmDy4irM4HqHHsm7Rkm1tYpBeh2BAoh:8maYDHHf9oBGcAoh
- TLSH T14E3413274D356C694E5AEE2F308F0E1E1FF64E97CA6569D185D48B0C238D9C81E45C35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 d21e8c0b70b16f87d6333aa050931c7bc854108829460fa57a21060d4b2651ae
- MD5 89a2058fc30458d9926eafd3d8fe5964
- SHA1 afcc3cb97ef64eb4e5b98683a2c5b199c4fb6a9a
- SHA512 43d074b294c074ea996754d2f000d96dce170e95acaee7b5427e43d67c38a4c7e856d43ee0e2a60cf00e2452f350d1750224b2cf1d178f4e19d425a01773efae
- SSDEEP 6144:HqrmDy4irM4HqHHsm7Rkm1tYpBeh2BAoh:mmaYDHHf9oBGcAoh
- TLSH T1053413765D316CAA4E76EE1F308E0A1A1FF14EE3DA656DD185D48B0C234DACC1F4AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 c7f79ce3b4a63218817de69c8266cfc18335f1d9a84fbd67b3066220d60aae2c
- MD5 cd714a9bb414455ff4726046ccfd9b68
- SHA1 8f550ee508bb47bc4d5e735e0f65ca2511717e8e
- SHA512 fd3f3be2b282ef4949da7244fa4fe6a3f9860d06a1ee2290e967f8421fa19c6287f586b7cc9555d152332cfec6bd1036b98dba0e08486901635cdbe289178bda
- SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:5m7Rkm1tYpBeh2BAo+
- TLSH T18FC3122B5DB5A9375DB9BB5EB04E0B1F1EF14AA6C920CE52C8D85B0433EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\PhasmoCheatV.zip.crdownload
- Size 2.5MB
- SHA256 ed73fe7284ee25c249c9d6ec444a7248118e9129ebe39e7d500d1ef77fed6312
- MD5 e694cb3e966cca45a4faaf846d50de34
- SHA1 d36f2ee7668108d7c6a3ba4969f8cca76cce6afa
- SHA512 527d9fb6d5d946322237d1e9d4ce084d838b43f4987dbdd41aa6f72c91cb7b7dc092c559a85ca09476c5967574fc127501b70c9e0386ffb0c1bba21e00ff1e9b
- SSDEEP 49152:dlRVTykCW12u9nbHBeHiimnA3zP+aQJ5XZqSoUCIlbmIn4+QAkJyhftY:dlRV1Su9nbHSmnA3zPSJ5pqSoUCIl4my
- TLSH T1D6C533A2C51DC5B61824F26837B1FC009A75C426D68D44A4B8FC3D215FFBACE86B4DDA
- MD5 SHA1 SHA512 SSDEEP TLSH