dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
396s
max time network
399s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VencordInstaller.exe
Size 9.9MB
Sample260810-pg3yhaybla
SHA256 dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871
MD5 1b8ee61ddcfd1d425821d76ea54ca829
SHA1 f8daf2bea3d4a6bfc99455d69c3754054de3baa5
SHA512 75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a
SSDEEP 98304:jmPUf5A91QP5oToUsbeRwcyHekFeSpc12EKw+KVktWHBLmpTN5huJd3kMerGpNTt:SqqQP5oKswpLi3gOW
TLSH
T13BA65C47E99241E8C4AAD1308667A273BA317C151B2427E72B90F7382F77FD05EBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1580	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308379689302016"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
1384	chrome.exe
1384	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2560	VencordInstaller.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4132	5004	chrome.exe	82
PID 5004 wrote to memory of 5404	5004	chrome.exe	83
PID 5004 wrote to memory of 1580	5004	chrome.exe	84
PID 5004 wrote to memory of 5404	5004	chrome.exe	83
PID 5004 wrote to memory of 1548	5004	chrome.exe	85
PID 5004 wrote to memory of 1548	5004	chrome.exe	85
PID 5004 wrote to memory of 5184	5004	chrome.exe	86
PID 5004 wrote to memory of 5184	5004	chrome.exe	86
PID 5004 wrote to memory of 948	5004	chrome.exe	87
PID 5004 wrote to memory of 948	5004	chrome.exe	87
PID 5004 wrote to memory of 4768	5004	chrome.exe	89
PID 5004 wrote to memory of 4768	5004	chrome.exe	89
PID 5004 wrote to memory of 1896	5004	chrome.exe	91
PID 5004 wrote to memory of 1896	5004	chrome.exe	91
PID 5004 wrote to memory of 436	5004	chrome.exe	92
PID 5004 wrote to memory of 4680	5004	chrome.exe	94
PID 5004 wrote to memory of 2396	5004	chrome.exe	95
PID 5004 wrote to memory of 2536	5004	chrome.exe	96
PID 5004 wrote to memory of 1384	5004	chrome.exe	97
PID 5004 wrote to memory of 896	5004	chrome.exe	98
PID 5004 wrote to memory of 896	5004	chrome.exe	98
PID 5004 wrote to memory of 4880	5004	chrome.exe	99
PID 5004 wrote to memory of 4880	5004	chrome.exe	99
PID 5004 wrote to memory of 3920	5004	chrome.exe	100
PID 5004 wrote to memory of 3920	5004	chrome.exe	100
PID 5004 wrote to memory of 3932	5004	chrome.exe	101
PID 5004 wrote to memory of 3932	5004	chrome.exe	101
PID 5004 wrote to memory of 4400	5004	chrome.exe	102
PID 5004 wrote to memory of 4400	5004	chrome.exe	102
PID 5004 wrote to memory of 3344	5004	chrome.exe	103
PID 5004 wrote to memory of 3344	5004	chrome.exe	103
PID 5004 wrote to memory of 3212	5004	chrome.exe	104
PID 5004 wrote to memory of 3212	5004	chrome.exe	104
PID 5004 wrote to memory of 3592	5004	chrome.exe	105
PID 5004 wrote to memory of 3592	5004	chrome.exe	105
PID 5004 wrote to memory of 5796	5004	chrome.exe	106
PID 5004 wrote to memory of 5796	5004	chrome.exe	106
PID 5004 wrote to memory of 8	5004	chrome.exe	107
PID 5004 wrote to memory of 8	5004	chrome.exe	107
PID 5004 wrote to memory of 3336	5004	chrome.exe	108
PID 5004 wrote to memory of 3336	5004	chrome.exe	108
PID 5004 wrote to memory of 5816	5004	chrome.exe	109
PID 5004 wrote to memory of 5816	5004	chrome.exe	109
PID 5004 wrote to memory of 1764	5004	chrome.exe	110
PID 5004 wrote to memory of 1764	5004	chrome.exe	110
PID 5004 wrote to memory of 4104	5004	chrome.exe	111
PID 5004 wrote to memory of 4104	5004	chrome.exe	111
PID 5004 wrote to memory of 5128	5004	chrome.exe	112
PID 5004 wrote to memory of 5128	5004	chrome.exe	112
PID 5004 wrote to memory of 3996	5004	chrome.exe	113
PID 5004 wrote to memory of 3996	5004	chrome.exe	113
PID 5004 wrote to memory of 1900	5004	chrome.exe	114
PID 5004 wrote to memory of 1900	5004	chrome.exe	114
PID 5004 wrote to memory of 2464	5004	chrome.exe	115
PID 5004 wrote to memory of 2464	5004	chrome.exe	115

C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb88cc728,0x7ffeb88cc734,0x7ffeb88cc740
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,18271534571814574128,11452996907096837091,262144 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,10004905415036613959,16512371867543597032,524288 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,18122812116546109676,6826470826197810434,524288 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,15969230580571202176,13299900077052152136,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,390545602703193008,14853446845938942201,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,12491609717892047366,2697660583116793258,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,10120653950367696527,8260920599938697572,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,10318854253113945862,13595899972394091929,524288 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,16799739301124409204,15806613214773498949,524288 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,5101764886023907438,5991615317072481911,524288 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,8496068610567658995,5135985679518830114,524288 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,12849694408077020224,9377776551695016395,262144 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,4096676426763483488,6976962418234991522,524288 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:14
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5996,i,18329343694049430237,7582410554196232057,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=872 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4744,i,16955759958551977159,10650229178162542687,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3688,i,2659398539470361381,3425956348308386335,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5772,i,11585133819169886085,17389621119329939093,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3500,i,165490554679646176,6503851885318076060,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6252,i,485427869484461777,10859393251997604296,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5784,i,6933306316956056465,7817079070033060923,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4760,i,3508163927648407726,15053851634586370738,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4904,i,14093348276299451791,14738860372498414000,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4776,i,16767933250459592636,6073436971947112448,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4724,i,11208642562289547829,16032089316546633398,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4796,i,11953943076916966797,10983017951813093215,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6508,i,11912773189007916726,7422272248939102231,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6516,i,17166420252573435657,7147899403945325063,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6936,i,11406111655416054211,9514902087250751330,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6440,i,15929119862067193692,442227699820015396,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7124,i,6340746172667767219,13632175887663942473,2097152 --field-trial-handle=2040,i,213350132184687478,2443826142305010125,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:2464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a467d0340e7549aa8a5e3f91b6de7dc8779e64560b2a48ba3fce4a4f2635d9e7
MD5 aa9d498a2fb41364c8602890c14e06a0
SHA1 361f945d09439a7243595d2b17ba7350c3fa5f6e
SHA512 df1f229a1f180886225836029f677b4c9902c69d128f53fae2f39666ab38b4b647b4c7e5d4e3cd1cef0f567e7c78cbb03d483a8749bb32298a1761a6f3bfba55
TLSH
T145E022AAC921AC270EFD2BAC61955745E76003573B819A2F3B3C910C8FB6A7A558681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c2861a9dd7c0d7d690f91a8a01b719c5e37a02363ccc6049ce45a724e08436ac
MD5 45947e658e879b1cc500e93effa0925c
SHA1 06315878fbfb6fb3c69c94b1807f8167655210cb
SHA512 fd86471dcd102789ffc24e75629dd3f9a0536b51550652f70f08ea64a90a25bab804641aa2fe29b52c2716ee3c1390d911676bd0be07beb19782fa340a87f595
TLSH
T15631B81258B161DCFBD23638EDE74CA13070849B84137E96C7160D7921B7FE60393349
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ed34ac67bd50a1b6417e45c4a130bebf9c89ef10ffd4938790cf94f7a899681c
MD5 2fbbdb40dee5b4f24fab2803d47da532
SHA1 6996933c965f18f50e9c261fc7e37952cbb18abe
SHA512 b1a599064718e997226ebcf4ddd56f86ab05b0a96cbea3e3360b1838b1e1fa95869dbe789f52db9a327037358f1fb0b993ab24c1d8e831b547545e3542688e03
TLSH
T194719CF3C3E49A7E851196F4DB256E1FCD290A25122C3C62C9D4AE1B53F29B7D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 679f3d7119ac3e9ce8aa19a913e48dbd7f4420004b0004a8e356191b03f2cff9
MD5 0cd7d1e5ab6d8778996f19b8bcb88c21
SHA1 c179e75ce8419b3663ad62f4e06468b59f027dac
SHA512 0f4db9b417c45b4c5dfa77fbf9149f18dc3200f4ae35d6868717f787f2238997e6df752564f02f148d8cdf0663ce7315bfd08080bf1bf3fabb8768e76d0aed39
SSDEEP 48:YALlqY5qqhPqKNqiqzaXYfoKsx4s3gmzspfsGosk7MsyfmsKjsE7sbbsM3a:Db5TFpNVEaIy3OfU72YdqpK
TLSH
T161918BB3D3D48A6DC41166E5DA216E1FCD390A25122C3C62C9D8EE5B53F29B3D30138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 79bfff017d2d146f7273107f7692859fcf8257686050d339ae68053cd8c9482e
MD5 b3f87acd8d3904c6b1f4eaf17c79f4f7
SHA1 2e12af898b9cf2e55517abb652a4780ebd73d097
SHA512 eef59ec8762b05799bd5db79309b650286f7919d54bc5a16e2e1fb54019d8e5ed80101a07db95428bdc01727323ea0242bed9802d6dc4e4651445613f37ec93a
TLSH
T1C55189F3C3E48A7E891196F49B256E1FCD290A14122C3C66C9E4AE1B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 90b82c0ec6394961fc9981a3a5d432b9759ba2f20b35da417ac38ae54c1fb01b
MD5 8e7b2d6330c32c18cea35fbf8728c882
SHA1 4ab6a7271450a0214b555f2f3727657cac5ad3ed
SHA512 d47410db14b8798b98a341c0dc4f223e59a34285d9100f54d95368ec02941abf0c2860bc1aa776e8db096fc8e41140423b23655de05ad34cfe41656eded5bf28
SSDEEP 384:DlTF3V4HGE7xnulq+uap0evrmJDRaIy3OfU72KqpXswX3XxP1mAvXdAJR1XWyb4I:wBPn1rvPHc
TLSH
T14C627DF7C3F9866EC81163F09A253E17CD690A15422C3C5BC9D5AF0B57F28B1E291A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1f1498e3d45e6bf2a8bf11465e3536233305fe6c5a23499fc728bec3db83dcd1
MD5 298b423fb6617f6dc7cdec8bacca07d6
SHA1 7a2ef17965251cae47be139cf6e8da3ae64c8aa5
SHA512 de74256ecd319034e249ce49af68bcc58b9003f0f07537b11fca7d9bf2c76fe6996a764a51e836aab18f36e2cd83bcde52fb7d287afb01ec1c0f9e97bbacbe8f
SSDEEP 192:wRPnvvMOmHAII/nv7HpYPRpSy9DHsb+WNnx90Iz264kwoa7rVyIsnAUgraJ:wRPvvy+nj8Xd5w/0G2TIaRe
TLSH
T19052FA2EAC14693B9CDAD659FA157BA3D7F8103121D01E98F6FC8A3C05E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3511297d34a89b8572efba43cae922539ccd6e35cae10a15796d2e093769fbc3
MD5 3f60212bcd51aa9d04ae367538009ac7
SHA1 4ba60a1f6e76cdc6bb69ba391cd615d9d1a28231
SHA512 d5450259714602527bd808478ff54fbba8e74b4f0a94ee383a266267c0f8deb84a9da7e9616c3b6ccb83c8ae02aec110cb149d38cd16dbb776a32578fe976180
SSDEEP 192:wRPnvvMOmHAIQtv7HpAPRp2y9DHsb+WNnx90pz264kwoa7vVyIsnAUgraJ:wRPvvyqNjUXR5w/0h2TIade
TLSH
T16842D83EAD14693B9CDAD659FA157763D7F8102121C02E98EAFC8A2C15E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd782b5e967b569a479f131761052f92b3d98e3be6427834aea55a412d1ee49c
MD5 ec4dcc1e187bd11e98cabf35317d5223
SHA1 c02a38d2870e0e124b35342dc2243b3d7d450eed
SHA512 3a738e88ec7acb135d5529bf87e57214fe0a10a9e690643f77ec9234e6d46ccb61cde4e7170123753323941e496a1dde01c8ead56aab2b65c15eabb33a506c0f
SSDEEP 192:wRPnvvMOmHAIQZv7HpAPRp2y9DHsb+WNnx90Mz264kwoa7GVyIsnAUgtaJ:wRPvvyq5jUXR5w/0K2TIaC8
TLSH
T17D42C82EAD14793B9CDAD659FA5577A3D7F8103121C02E98EAFC893C14E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bb4c86370fe8e99ab883dc7f8e9d846c0bdbce48108d49437e9e06ae6fff7fe7
MD5 2478ed295df38ee21990b084ce5f2d19
SHA1 85e6511efdfacfa511fd74b8299391f81e7fadbb
SHA512 a7c2a266d26771dd24f164095ae3036d394bfd4c84d3f6f9ae30b016d8072105cca63ac730ea02bf5bced8cde134daa22c6a80de9f9f9a8872d5bba45bdc28bb
SSDEEP 192:wRPnvvMOmHAIj/nv7HpYPRpSjjp9DHsb+WNnx9Idq2sz264kwoa7rVyIsnAUgraJ:wRPvvyVnj8X45w/D2q2TIaRe
TLSH
T18052D82EA824693B5CDAD659FA557BA3D7F8103121C01E98FAFC893C15E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 44b8804072cfaa1b01e7c769f123c5960a3da27c9fbaaed13786321d5dd48ed7
MD5 e113b34d3160a1425c18c725ab7a2ac0
SHA1 a8b277fdbad913cc3ae52cb1511e6a3ece79b9a2
SHA512 29760bccf332e783b9d704ae8b57ab8a5bfa2692582c10cbfa9111f642b4238a2754665f2395469d818bdf9ace0ba69d42fa096da76b1d5977b9083c4c8e4e3e
SSDEEP 192:wRPnvVMOmHAIjfv7HpYPRpSjjm9DHsb+WNnx9I8TE5z264kwoa7r8yIsnAUgraJ:wRPvVyV3j8Xb5w/nEx2TIace
TLSH
T1C452D83EA814697B5CDAD659F9157BA3D7F8103121C01E98FAFC8A2C15E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d7bb1a264f586b2a1225a3225bfec17e099a88feb80f2aafb1ab6b323018ddc6
MD5 9abab67903ca4829e180b8af10d7006c
SHA1 1ffcadc0513ac12af012d34c4a38d77cf3126b2d
SHA512 46a282557c19c06cb2b7f66e0f9794722b20e17fb767569dfee1fb567b2929a175627781bbe09dabc6ca7a13c03b972862d743b87d15455b04462412a4116312
SSDEEP 192:wRPnvVMOmHAIj9v7HpYPRpSjjm9DHsb+WNnx9IoPeNz264kwoa7rVyIsnAUgraJ:wRPvVyV9j8Xb5w/PeF2TIaRe
TLSH
T1D852E93EA814697B9CDAD655FA157BA3D7F8103121C01E98FAFC8A3C15E79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b42bc98c686149c1d60c5bb893657d6208afb9df899f71a0e3bd5076821dd7e
MD5 3488909681e561349052f9560a624c7f
SHA1 5469be5af15154500579771e79f61cc611c1f9e9
SHA512 18c0419d1278fd8b8641e6df354d750ddd110773aa61c489f6452fcf05e1f132be53215a5a25ca6c9c9cc63f10acdd67bd899ceb475b719bf8c8f81a668781bf
TLSH
T197B012628001F151C45202F41642148C73149F10B70A170153F4B932C9351A08414052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a1aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a1aa.TMP
Size 96B
SHA256 ee9f0bfd0618ce4ace6cdd0b666473d7216ebab7e58c7712011d5e9d76fa8b89
MD5 acadc52bdd25d8b3da4448aa21a79cf6
SHA1 b66144d91f547559f4ccce0fdf8cc3ce74e921aa
SHA512 65f908198fdebf724b48f1cd238b1a7f3c78e29565730d5a1868bff596ea5e490ce1a0c995cbaa09e1d982685a453b91316168ea9dea951ba5ee9bdfa93d828b
TLSH
T195B022AAC002A383C00203B0288E80E830A0EF32E303320282E03E33CCB02300220020
MD5 SHA1 SHA512 TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 bcdacd1e7de91188e4ce782b633fe98e2ffed77295b5622415dc1482e03fbe3a
MD5 4599f428f3b48d17b7e568fa3c629382
SHA1 b8ed66e1d3d5dd4753bf4680cbf9abd66a24267f
SHA512 38606b0d7e9649718cc10210f5d7c53ade54406070262d340f7583d661649dafa069a11d80530ad525870e14d6f021bf0d5b2c74d53e0bb56f6e86f5dcc042e2
SSDEEP 6144:928QGnRUUf0ZwVW6OHCFPn6s01Wim7Rkm1tYpBeh2BAoH:WGnRUUlVW6OHsnB9oBGcAoH
TLSH
T1CF34233B0E71AC765DA5F778308E4B6B6EF94AA3CA00B99A40C46F4087DC5DA1746F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 277KB
SHA256 a4335a99b9a29f7c09e7c4ff1fb0ef34174ea0354d9c0e3e242d8a91af6d6bff
MD5 dc1466ad10cdf643e80bdd4f2a35f1f9
SHA1 f48647a19dc02b196c864e951afcaef21f8b425e
SHA512 ebc5b73f6c63d825cc26a04071fe183a0ad6a07bc4aa63f1e80959e853722d040c633c5cfb52594ed32cd08c92a9afbf35813e6673ab29cc96c6d0eb9360c4e5
SSDEEP 6144:2+Uxlj8QGnRUUf0ZwVW6OHCFPn6s01Wim7Rkm1tYpBeh2BAoH:GGnRUUlVW6OHsnB9oBGcAoH
TLSH
T19E54233B0EB168B24B94F72C318F476FBDF94697CA14799A44C42F80878DAC71685B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 95e420d89e14e09b232523bfb45bf3a0e962f425ed2a9a914fe08376388def6b
MD5 a464c4a47c764639f9b07d76ea82c6cd
SHA1 809cc8d2b493aee094eefe6460516a8e11030344
SHA512 836798609e5aa9bb0b0dfb92e2ae6d3136462bdba616d4e7aebc0eb4cabcacf9e549794040f38796eab82ac3cf613a1b63cecff4cbd5087d70a89f2ab59c2e4b
SSDEEP 6144:68QGnRUUf0ZwVW6OHCFPn6s01Wim7Rkm1tYpBeh2BAoH:MGnRUUlVW6OHsnB9oBGcAoH
TLSH
T13334223B0EB1AC7249A9F73D708E467F6EF60AA2CA10B8D640C46B4087D85DA1785F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7e9f56fec3008749088664212c501988c2b3f105ac2f2dbd9e6d09e958f20035
MD5 791c26e8acfcaab4317fb268caaea5c8
SHA1 33343c6dadc3071b030af06b92d9354903a788e6
SHA512 aa6d98c9417f16f467ea9bfeeab5a4b8e13afbcdd90000e9b0fe6a4738f1a2989d51601c3fa7ff73905adf029b33988446133b54f0116777876c4743fbee9dc6
SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:lm7Rkm1tYpBeh2BAo+
TLSH
T197C3122B5D71A93658B9A74EB08D0B1F1EF14DA6C930DE92C8D86B0477F66CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef85589a-5fb3-4056-967c-7c1007306eae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ef85589a-5fb3-4056-967c-7c1007306eae.tmp
Size 235KB
SHA256 de84a7f10f6578280f5ecd1da73b8346131dbbfc780201ec96bb501416b6a4c8
MD5 6be5f7f175e29c7814d219787165b6e0
SHA1 2e88e46c48f8dfeab86f9b9378540c322b12264b
SHA512 419bf86e847a2ecdf6dad798ad16bd56bd61f871dada66f9c50daf8e7ff4f4b18cdf86457ee332b1667626ce052c02dc69245ded8cbaf9e7ddb7df9960220d27
SSDEEP 6144:H8QGnRUUf0ZwVW6OHCFPn6s01Wim7Rkm1tYpBeh2BAoH:pGnRUUlVW6OHsnB9oBGcAoH
TLSH
T11034223B0EB1AC7249A9F779708E467F6EF64AA2CA10B8D640C46B4087D85DA1785F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2560-0-0x00007FF7ECF30000-0x00007FF7EE1A9000-memory.dmp

Download