c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb

Resubmissions

09/08/2026, 01:05

260809-bfnkjafp6v6

09/08/2026, 01:02

260809-bd13vagb546

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM.exe
Size 5.0MB
Sample260809-bd13vagb54
SHA256 c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb
MD5 9bc89d3b1400d2ec8db893bdc4db81c1
SHA1 f5e266a08a31ffb7e0b7be6d536d06d4ebc894b0
SHA512 fbe870cf6e1cc9040663cae11b7a82cac9e71c6ede0d1ea4cbdeb34f692dcd618d556801732b53d9010299fbf46ad04fb238051747d598825eb7f61c6b19c0c7
SSDEEP 49152:TOjPWIYgLg9GI35nZemOvAVDAIqNVB+VSavnAERUtnzrNKY3rNgMVBE5IouLTdaO:vGIVqvB+VvYxUCBaKcw0xCoBkdH92kr
TLSH
T11136AD5673A400E8D5B7D178CA968527E7B2BC061371CBDF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2228	GameBarPresenceWriter.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
2388	FiveM.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1360	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Colors	FiveM.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307109622030484"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7377F5F5-E943-40FA-876D-6DD210C2FFEE}	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4988	FiveM.exe
4988	FiveM.exe
2388	FiveM.exe
2388	FiveM.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2792	chrome.exe
2792	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	FiveM.exe
3076	OpenWith.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2388	4988	FiveM.exe	85
PID 2120 wrote to memory of 5056	2120	chrome.exe	88
PID 4760 wrote to memory of 3764	4760	chrome.exe	90
PID 2120 wrote to memory of 2464	2120	chrome.exe	91
PID 2120 wrote to memory of 2464	2120	chrome.exe	91
PID 2120 wrote to memory of 1360	2120	chrome.exe	92
PID 2120 wrote to memory of 1904	2120	chrome.exe	93
PID 2120 wrote to memory of 1904	2120	chrome.exe	93
PID 2120 wrote to memory of 864	2120	chrome.exe	96
PID 2120 wrote to memory of 2476	2120	chrome.exe	97
PID 2120 wrote to memory of 864	2120	chrome.exe	96
PID 2120 wrote to memory of 2476	2120	chrome.exe	97
PID 2120 wrote to memory of 1784	2120	chrome.exe	98
PID 2120 wrote to memory of 1784	2120	chrome.exe	98
PID 2120 wrote to memory of 4192	2120	chrome.exe	99
PID 2120 wrote to memory of 4192	2120	chrome.exe	99
PID 2120 wrote to memory of 3560	2120	chrome.exe	101
PID 2120 wrote to memory of 4908	2120	chrome.exe	111
PID 2120 wrote to memory of 4320	2120	chrome.exe	112
PID 2120 wrote to memory of 3700	2120	chrome.exe	113
PID 2120 wrote to memory of 552	2120	chrome.exe	115
PID 2120 wrote to memory of 552	2120	chrome.exe	115
PID 2120 wrote to memory of 4904	2120	chrome.exe	116
PID 2120 wrote to memory of 4904	2120	chrome.exe	116
PID 2120 wrote to memory of 4688	2120	chrome.exe	117
PID 2120 wrote to memory of 4688	2120	chrome.exe	117
PID 2120 wrote to memory of 2612	2120	chrome.exe	118
PID 2120 wrote to memory of 2612	2120	chrome.exe	118
PID 2120 wrote to memory of 4860	2120	chrome.exe	124
PID 2120 wrote to memory of 4860	2120	chrome.exe	124
PID 2120 wrote to memory of 4920	2120	chrome.exe	125
PID 2120 wrote to memory of 4920	2120	chrome.exe	125
PID 2120 wrote to memory of 3812	2120	chrome.exe	126
PID 2120 wrote to memory of 3812	2120	chrome.exe	126
PID 2120 wrote to memory of 2012	2120	chrome.exe	127
PID 2120 wrote to memory of 2012	2120	chrome.exe	127
PID 2120 wrote to memory of 2440	2120	chrome.exe	129
PID 2120 wrote to memory of 2440	2120	chrome.exe	129
PID 2120 wrote to memory of 4628	2120	chrome.exe	130
PID 2120 wrote to memory of 4628	2120	chrome.exe	130
PID 2120 wrote to memory of 2928	2120	chrome.exe	131
PID 2120 wrote to memory of 2928	2120	chrome.exe	131
PID 2120 wrote to memory of 2792	2120	chrome.exe	132
PID 2120 wrote to memory of 2880	2120	chrome.exe	134
PID 2120 wrote to memory of 2880	2120	chrome.exe	134
PID 4652 wrote to memory of 2468	4652	firefox.exe	136
PID 4652 wrote to memory of 2468	4652	firefox.exe	136

C:\Users\Admin\AppData\Local\Temp\FiveM.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
  "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Executes dropped EXE
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcfb00c728,0x7ffcfb00c734,0x7ffcfb00c740
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,126511715996319552,7870502162736255799,262144 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,15216333693034279908,15848870418671183496,524288 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,5525867624782308862,4007406593733022971,524288 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,6719300205104732987,6728391332383941495,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,7206697238597786182,10972261734490206992,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,1962698235035737174,2429995401082959757,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,12910821172126673775,16001716360553403543,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,14498471540343828680,396542134561267309,524288 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,12410904279815322678,2788656531762273812,524288 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,3371523914052081001,17495885378146487418,524288 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,13665982389010438780,18389085280652987251,524288 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4148,i,2721798956020983310,15976994815404560887,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4724,i,6495355894590725110,2544569217675371556,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4712,i,17459620744875696888,1129421370095190723,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6000,i,3354631267356477666,13463300856478224246,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5936,i,16048484968611450599,12550089826642208027,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4696,i,16001587380963308084,11570150608651713322,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5848,i,3977790801746067092,18185885043181973427,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5608,i,1048672774738198944,6913015326841803701,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5484,i,7908445836571564489,8211103174104787095,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5908,i,3648914539945944517,6676903354376251519,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5704,i,12725760792483842785,17325196939578521021,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6364,i,6153269290136632350,1451610969656292552,262144 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6416,i,14346284358233146879,13192283884166348650,2097152 --field-trial-handle=2032,i,8348378482250819910,5242824536884613657,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffcfb00c728,0x7ffcfb00c734,0x7ffcfb00c740
  2⤵
  PID:3764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4712

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {078c0d54-3149-4882-8e18-a6f4ad8e5c9e} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FiveM.exe

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Size 5.0MB
SHA256 c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb
MD5 9bc89d3b1400d2ec8db893bdc4db81c1
SHA1 f5e266a08a31ffb7e0b7be6d536d06d4ebc894b0
SHA512 fbe870cf6e1cc9040663cae11b7a82cac9e71c6ede0d1ea4cbdeb34f692dcd618d556801732b53d9010299fbf46ad04fb238051747d598825eb7f61c6b19c0c7
SSDEEP 49152:TOjPWIYgLg9GI35nZemOvAVDAIqNVB+VSavnAERUtnzrNKY3rNgMVBE5IouLTdaO:vGIVqvB+VvYxUCBaKcw0xCoBkdH92kr
TLSH
T11136AD5673A400E8D5B7D178CA968527E7B2BC061371CBDF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f46e987b393cd6609db2cfb81579623e6c1ff06cd5d0bb36f4f71348130de12b
MD5 37aee978b623a4a7825596a618a1dfde
SHA1 d7fcbead61319a98385cd4a3418cdc496d781a38
SHA512 b612325b6d6695670405a660640e2eb9f75d9065559194886b0ca8b67700037a92093fff9fe8eae3977455db1ae834eaff016ea1090be69bb683328dd3352109
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d2b871b233d3d691af822f1a5f7f92f37dd8af1eb3ce680174701a2c3f37f5e2
MD5 7b45968183f498a6d4b742963d665ef4
SHA1 19d6861daf870c08635139b3254b92734be5c458
SHA512 4d0c21b4808a906f92ef19917ecdd54d27ff0c430ef62cd2b8660a815c31cc134707e0ca3681ae0fbedb183e8ed74098bc426c151cb90169c48ec81824c5bcbf
TLSH
T1D8E022A9C821EC771CFE07285055078AE790235B2AA0590F7A3EA10CCFB0B2B41D6CAD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 755b48549a1bfce9959f779f61b12ecfb98e1cf295b371a71d0a0955894641b7
MD5 6050f928872b92fb841053ab3c9ab7df
SHA1 09d84a24b67c95c3c3c35e542733acb4fa959e81
SHA512 d77246656440657e9551a4d9986e13229528f7fe05c6bafe18755e0c1c04a04c0810ddbb51b3a290bffa1d4962f03fdd3da56d947c5c175aaac542d20a3a073f
TLSH
T1E7C0921890885286EB3489F264619A9012812E3A0A612387E2E7DECAD4137B362D2170
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd12c92d6ad106c6e8542d3b4df36723609d7334a71bbcb5f40dc25e8312a016
MD5 5ae0b2c28ca1a4d3ccdc91830a0451f7
SHA1 e4d3236a766b8cd325fa36af39d4048774a2d1d5
SHA512 892cc14de849ea7c624475b0a05469fe57da538dcf98bbfcd639b9f71577994d059b89ca40bb1b9a10a238f45a2dda67ca8b2f1041c9d78891f046c5164cb5ac
TLSH
T1B6518CF3D3E4867D891152E49B256E1FCE3D0A24122C3C66C9D8AE5B53E2872D30178F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 770b2b00a621965fd5df962c54f8e61d1ab514618071ca53204b62e974ce13e8
MD5 a52c545f01012bed89b3de393c6fa745
SHA1 7e80be5c31c2d68461a0b784a61668292b8cd443
SHA512 9a715fe84f717bec7ab179f59f8b039da4e39b56b91ecbb773d40f2d393fdd4f9150734727c95679732e3ce516264efc6ad916478a6823cecf48aa3c8f6ce8e8
SSDEEP 48:YALlqJqodhihdGh2vafo7XLs/gmzs4fs4eqs2osWKsz+s4wqzs4GtsnVcsNjhhnw:DiJwqYaaejLeAGpOwYG2hjhNE
TLSH
T1ED916EF7C3E8852D891156F49B156F2ECE2E1924532C3C66C8D8BE5B93E2472D21174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 916046cb071a02ef0922d2b523f03e2b05b89a9a9a01208957d3e71fde8a933b
MD5 43da012f0e4f29c644953988bd0cadc1
SHA1 6837d73e9a2eb5942b4130d9290b1ab4e2583830
SHA512 7c0935ebe32fb978baa08888788803ceba18db137e9c15a7a543fd632d27d6d037f14233b097fb2326e1648ef07342f5f56e81264da6b4dea280cda58c589adf
SSDEEP 192:kRplrmwjILIrZwC/Gv7spAPRp22F9wHsb+WNnnFn4O2aic5VyIsnAUgtaJ:kRplRULIrZ/yYUX/FKwFnr2aP8
TLSH
T18242C62EF915693B9CCBC22AF9227B57D7F5102121942D94E6FC8A2C15EBACD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 38eb8a20f4e48e8d0944da31b1e1ef22092c5d2fa9dfb2e672da3c35b69049c7
MD5 d68acb896d844e8a9595e32054371ad9
SHA1 58c88a6055b6b61a23c95be4e918f9b30f68a36f
SHA512 0723eab0e6d0511d810b7d97b806dcb19eaf76f00305da1812af523983683ae3d9466bdb88e2adcbda5a5c5dd4cfbc2ae3636ec033bb115a2de860658b364bb1
SSDEEP 192:bRpl/mwjILIrZwCxrv7spuPRpo2mMB39wH0nb+WNnyaoQSj5+xfEKO2aicuVyIsB:bRpltULIrZxTYCX1pK+YhkEV2a2e
TLSH
T17762D72AF924693B5DCBC22AF9227B1BD3F1102121942D94F6FC8E2C15E7ACD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d496c3b4998ff27d56353f9f2ce40abf6fca00f9570af8aebbf9a90e260c28da
MD5 63e5e092379425dda8a9ce6c28816add
SHA1 30b330d09dd02a2b90cdc240a7205bcb6ec2d3e6
SHA512 a22330ceb451b9f2bc3592dce8906919b82d6d8c159e7d5a18f0b01944c8ee1d7c255a882c7c62d291739eb1f3953509d2f722cb6dacd3a70fe53145275c23f5
SSDEEP 192:FORplrmwjILIrZwC1Fv7spuPRpo2mzAe9wH0nb+WNHLNzcSj5+w+2zO2aicuVyI6:FORplRULIrZ11YCX1qKWhdY2a2a2e
TLSH
T1C662C62EF824293B9DDBD22AF9227B17D7F1106121942E94F6FC892C15E7ACD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 477a097bfe334c33f195fff34018bb5b54d925f9d2a9d490a9ccd831c860fe56
MD5 414c44ab92d2c2518f9e5a914c138b4e
SHA1 857636bb43e825f3ecfc5b35b70e9871123f94b2
SHA512 74f2b5ddc2ff92699d1c76007eed63ba38605abb866272bedcf813d8f4fac70b0fc68f5b84b879d30b154a6a54a97018f83acf066e8106fa70ae02d1ea876428
SSDEEP 192:bRpl/mwjILIrZwC7Fv7spuPRpo2mMA39wH0nb+WNHLaoQSj5+f1WEO2aicuVyIsB:bRpltULIrZ71YCX1CKWthQW32a2e
TLSH
T14A62C62AF924693B9DCBD22AF9227B1BD3F1102121942D94F6FC8E6C15E7ACD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f78ab7aac5614293e0051c37b9ed4c2c1b93425bb0c66fbd7b35e78835bc16e8
MD5 e9fa6be1807ce4f0d29333fd938a146b
SHA1 85c727d632800c9b77a3f2e6a0bf56d80263d2ca
SHA512 d2a967b86e1767edef5090a101b2a57b7144d4e162c755dca8f4082881fcc4dc9797485fb1ddaeb3117584ac99fbdbfee357bf6f3efd8fa0389e0eac6f3d5396
SSDEEP 192:bRpl/mwjILIrZwCPkv7spuPRpo2mMB39wH0nb+WNnyaoQSj5+xfEKO2aicuVyIsB:bRpltULIrZPAYCX1pK+YhkEV2a2e
TLSH
T1FF62D72AF924697B5DDBC22AF9227B17D3F1102121942D94F6FC8E2C15E7ACD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 540ea335ebe37cafaf40a0a52187a6d707832f96a6399bea0052450803088788
MD5 82587c07ac84cdf96f01ec291ccaac59
SHA1 790f59ebbc7e8fb19e364a6ee4a625ae00f2895a
SHA512 4a92979ca31bf17ff28b20af1f489fc6fd302f370728ccd8011b54c1cac74aa91e1574f7ea7a1140ce9fd8609d15a16f5ba331c81658530903876805404435f9
SSDEEP 192:kRplrmwjILIrZwCcFv7spAPRp22in9wH0Xb+WNnnFnmO2aicSVyIsnAUgraJ:kRplRULIrZc1YUX/IK+FnB2aCe
TLSH
T1D152C62DB915693BACCBD22AF9227B57D7F1102121842D94F6FCCA2C15E7ACD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 731c1f9b3a264cbb884d12744000b2d5f24a4ed4197051ef9c345da27600195f
MD5 a52606b92b2b896ba1172bf578b2f934
SHA1 37885cc2a23aad419dda3f12a71723dc008bbced
SHA512 875bcd160a77b4a329ab076912d733225d815ba3d263b19c6225e6e0e78f6349939dea68a62fd3bc20267943ba8812aaa5511af04dc1d21ffac235b7c781a7f2
SSDEEP 192:kRplrmwjILIrZwCCFv7spAPRp22in9wH0/b+WNnnFnmO2aicSVyIsnAUgraJ:kRplRULIrZC1YUX/IKGFnB2aCe
TLSH
T11052D72DF915293BACCBD22AF9227B57D7F1102121842E94E6FCCA2C15E7ACD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b3ec4aa4d5deb25f9bb4eef907394093361da8b9f05f2c9272df9b438e72e307
MD5 f14ceb847881a19f649df66cb3c143e8
SHA1 ac54aeb417da666148e88aa4684284c72ba6b7fc
SHA512 81c871eee64f18b5c52b225bad5d02977ad5a4fd14ba2d28805ae244cd28f1c748e80d59445ae43f2e7357025bed3b761bbb10e68021701bbc14c3c1be2bcc87
TLSH
T185B0128181015611C00206F42156188C7215AF20A60F174143E0A9B28D252518025071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e00.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589e00.TMP
Size 96B
SHA256 0bf741ccb94878486b47ef9755eb0deb929c1c16100770c47fa6f6e159c1a066
MD5 f304c1e75b55296e9465eaf2d1d69a0a
SHA1 6ea90f31e1b9a7d926e7f0bc91683574d9cb6a9b
SHA512 6a4c6184df622ac26e20af157657654e260b2fc23139ae270592c4391741d4d0c4f60acfa11442f6ef339d0eb63c87a697893d1e00d64cde116383e11670f164
TLSH
T173B02200C2022203C08203B02C8E80C83020CF2BC323220282E00A23FC382200828A20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3caf0d169b29a0d55d8b7f9ae40edd2398f53dd5fd0d9c503b701c6d1f295a81
MD5 b7710a9ef7958c06edc6fa506f9500a6
SHA1 d23f3293b186a7b04bf49b5c725affd3670e143c
SHA512 a376cb2643ccad25258711412c3fbbd836655d428a70a4c2f88a8bd7d5b42647eef4d0fad2dffaaa8f9ad6c229084df0ec881fdd67ca02d0be4685a5b38a6530
SSDEEP 6144:vBQhxNPRW2PYddqmY7U52F2m7Rkm1tYpBeh2BAox:poXPRW4Kq97UAv9oBGcAox
TLSH
T1123422227CB56D394C59FE1D308E3D2E1EF28EE5D464AEC6D8D86F08279F8441912D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 dfd62289369804bc28753b1a75d8bc2f61571a36e4dacc63d4ce6cdfe69496ae
MD5 c2109795308693cd3b1ef8e76919afdc
SHA1 a737838233b7b556616cc5033a0e765246d38b46
SHA512 cbe33fd86255f35d2195a3afcdaf49831fb8baf35549cb0dc4c64d8e28b3af34e4320a1397b759cc39fb60493904a56f7dda45eff2d2340e231024102710e785
SSDEEP 6144:eBQhxNPRW2PYddqmY7U52F2m7Rkm1tYpBeh2BAox:ioXPRW4Kq97UAv9oBGcAox
TLSH
T1253422227CB56D394C59FE1D308E3D2E1EF28EE5D468AEC6D8D86F08279F8441912D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 80b19a8af5d0db1428bd719c77f268bcf62d238dc8d4f51ca2b2090d28697205
MD5 aaa6b43095f05c5de7340cef591144b7
SHA1 e1107e789585d618c99e365b74a52d4534f1a2c8
SHA512 a199e6cf7293469a4f562166cb74827874d0194cdad3550335b376eaba9f759153a6c6275a99f49862c7465b347b36ddad0cb3bff411b0ebf6bdf13debff8204
SSDEEP 3072:dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:0m7Rkm1tYpBeh2BAoK
TLSH
T1C2C3123B5D65E8779979B70EB08E0B1F1EF149A2D920DE92C8D86A0477EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 72f347248f77af3864717117cbe7b18cd765f289b838a1722cfb564eee96deb1
MD5 1773e33da2ef2ed7042693a41ef9b6ae
SHA1 22235e88b1a53868c6a40d667652942584089b9e
SHA512 8557d38bb2d10f21536c3dbc01ee68a66db295bd8f7fc3df2dbea6d935f0e683b817046c69a86a2667520822bf4960f8f452f7cc67eb803fa8ed9e86901eb2d1
SSDEEP 3072:fGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:Om7Rkm1tYpBeh2BAoj
TLSH
T1BFC3123B5D65B8375DB5BB5EB08E0A2F1EF149A6C920DD52C8D85B0423EA7CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 9e443293e15ec429adacf275896ebc4281fb30fa12e9ab477398d2922d4eb05a
MD5 e6a7e7c63d21ee4d0e4c0a49a69b4980
SHA1 96c35a3bf8e5e905a92d558f9eab8ee80764c9d3
SHA512 6bbb6897c6b66fe07eb4e86bfd0938e97aa553a6aea1c98446f4b4cb35e6d04fed29d7bb35f8bfa75c650041e5f3dfaa163f5b1b3d98f19b66cb9ecc13511b7d
SSDEEP 6144:jhxNPRW2PYddqmY7U52F2m7Rkm1tYpBeh2BAox:1XPRW4Kq97UAv9oBGcAox
TLSH
T1DE3423126DB5AD394C5DFE1E318F2D2E2FF28DD494A4BEC2C8D49F0827AAD841512D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 73c32ce06712d207a228c85fbc816edc8604cd58cbb6c073c23ac540c059ef25
MD5 f746e451b5ea6878c09b0cd67347d26d
SHA1 bd8584a3bc54852fc52f113771d9fcc7f839e4d1
SHA512 f9d99a6ae01b9bf2ca7df980994425d72117a0c60a82780183cfb449f5518032a5791beecbc8174d36ae6613d31e2b97e993c905656b7e8db570c36289611728
SSDEEP 6144:xBQhxNPRW2PYddqmY7U52F2m7Rkm1tYpBeh2BAox:7oXPRW4Kq97UAv9oBGcAox
TLSH
T12B3422226CB569394C59FE1D308E3D2E1EF28EE5D468AEC6D8D86F08279F8441912D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 46fc3a8cc40c2be5adb6dbf1844895d61a1c19dedb4bd5a8c44a101adece4aa6
MD5 3fd2e758382a8c9ffb8bad0fa9e9a725
SHA1 76f61e1e59379e9a873c06b8794a666c08174292
SHA512 dbe3ab9a5b907d20add2c6460f967ed1a7b98ce1ed7022d2a23fb57470b4ab611e3a3b94a9eff391275e7fa55fe113d688da8074597dfc836c42deaa5dc3bac0
SSDEEP 192:cCitUwCitkB4ISjhlfrZCitqB/nRwDU7CitfCitV:cBtUwBt9l/rZBtgnRGU7BtfBtV
TLSH
T10A32E04027FB2619F1F39A36FEB537216F7EF8236904995E615183050961E00EE68B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 2ee648d3911dc5177823bd2acdb6508b2f6470a500c8897215f7d5d1a526a510
MD5 c4f06a5d25a1d00ba74bcf482e336e5a
SHA1 b0f6164936823152a294a5de87880228d1154af1
SHA512 f9db47385138336c57114f969e1632296360e2680c61c3cdadf3909435cac2f85edb9fe2f5a64308fcd74f63202d17d5bb8861b5396a8b6729c2920a557bae9d
SSDEEP 192:jCickB4ISjhlfrLCitqB/nRwDUlCittCitV:jBc9l/rLBtgnRGUlBttBtV
TLSH
T16522DE402BFA2619F1F39E36FEB537216F7EF8236904895E615183050961E10EE68F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 f7e410873e82d0709e59930cab103634444d73ba49ff1dde54726778af9804ba
MD5 e613bee5c523e40ee086a95af72538e3
SHA1 47be184045654c71f74b1f5ee5ad26dd3e36cf14
SHA512 c4230944b557f06fb96aab29123f91b6d349f4f2a77896a2f58a0b0197be37a52ffa84bc8e0b36c2fed58f2728476f20bdf679be2698e32456e79bdcf3ac77de
TLSH
T18541FD0259EA5F21D7FAC5B258F7A31185367CB2F3599B4E414183881C11E018899F9B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2388-9-0x00007FFD16EA0000-0x00007FFD16EA1000-memory.dmp

Download

memory/2820-579-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-585-0x0000022B54A60000-0x0000022B54A61000-memory.dmp

Download

memory/2820-576-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-577-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-578-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-574-0x0000022B54E10000-0x0000022B54E11000-memory.dmp

Download

memory/2820-580-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-581-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-582-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-583-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-584-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-575-0x0000022B54E40000-0x0000022B54E41000-memory.dmp

Download

memory/2820-586-0x0000022B54A50000-0x0000022B54A51000-memory.dmp

Download

memory/2820-588-0x0000022B54A60000-0x0000022B54A61000-memory.dmp

Download

memory/2820-591-0x0000022B54A50000-0x0000022B54A51000-memory.dmp

Download

memory/2820-594-0x0000022B54990000-0x0000022B54991000-memory.dmp

Download

memory/2820-606-0x0000022B54B90000-0x0000022B54B91000-memory.dmp

Download

memory/2820-608-0x0000022B54BA0000-0x0000022B54BA1000-memory.dmp

Download

memory/2820-609-0x0000022B54BA0000-0x0000022B54BA1000-memory.dmp

Download

memory/2820-610-0x0000022B54CB0000-0x0000022B54CB1000-memory.dmp

Download

memory/2820-558-0x0000022B44840000-0x0000022B44850000-memory.dmp

Download

memory/2820-542-0x0000022B44740000-0x0000022B44750000-memory.dmp

Download

memory/4988-0-0x00007FFD16EA0000-0x00007FFD16EA1000-memory.dmp

Download