dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871

Analysis

user interaction
yes
max time kernel
104s
max time network
88s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VencordInstaller.exe
Size 9.9MB
Sample260817-wn9syswyet
SHA256 dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871
MD5 1b8ee61ddcfd1d425821d76ea54ca829
SHA1 f8daf2bea3d4a6bfc99455d69c3754054de3baa5
SHA512 75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a
SSDEEP 98304:jmPUf5A91QP5oToUsbeRwcyHekFeSpc12EKw+KVktWHBLmpTN5huJd3kMerGpNTt:SqqQP5oKswpLi3gOW
TLSH
T13BA65C47E99241E8C4AAD1308667A273BA317C151B2427E72B90F7382F77FD05EBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5340	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314635985184735"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5260	VencordInstaller.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2628	4624	chrome.exe	91
PID 4624 wrote to memory of 3444	4624	chrome.exe	92
PID 4624 wrote to memory of 5340	4624	chrome.exe	93
PID 4624 wrote to memory of 3444	4624	chrome.exe	92
PID 4624 wrote to memory of 5972	4624	chrome.exe	95
PID 4624 wrote to memory of 5972	4624	chrome.exe	95
PID 4624 wrote to memory of 1916	4624	chrome.exe	96
PID 4624 wrote to memory of 2616	4624	chrome.exe	97
PID 4624 wrote to memory of 1916	4624	chrome.exe	96
PID 4624 wrote to memory of 2616	4624	chrome.exe	97
PID 4624 wrote to memory of 3176	4624	chrome.exe	98
PID 4624 wrote to memory of 3176	4624	chrome.exe	98
PID 4624 wrote to memory of 2384	4624	chrome.exe	99
PID 4624 wrote to memory of 2384	4624	chrome.exe	99
PID 4624 wrote to memory of 3428	4624	chrome.exe	100
PID 4624 wrote to memory of 696	4624	chrome.exe	101
PID 4624 wrote to memory of 696	4624	chrome.exe	101
PID 4624 wrote to memory of 1504	4624	chrome.exe	102
PID 4624 wrote to memory of 1504	4624	chrome.exe	102
PID 4624 wrote to memory of 3056	4624	chrome.exe	106
PID 4624 wrote to memory of 3056	4624	chrome.exe	106
PID 4624 wrote to memory of 2508	4624	chrome.exe	107
PID 4624 wrote to memory of 2508	4624	chrome.exe	107
PID 4624 wrote to memory of 4140	4624	chrome.exe	109
PID 4624 wrote to memory of 4444	4624	chrome.exe	108
PID 4624 wrote to memory of 4140	4624	chrome.exe	109
PID 4624 wrote to memory of 4444	4624	chrome.exe	108
PID 4624 wrote to memory of 5512	4624	chrome.exe	110
PID 4624 wrote to memory of 2488	4624	chrome.exe	111
PID 4624 wrote to memory of 2488	4624	chrome.exe	111
PID 4624 wrote to memory of 5512	4624	chrome.exe	110
PID 4624 wrote to memory of 3724	4624	chrome.exe	112
PID 4624 wrote to memory of 3724	4624	chrome.exe	112

C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf2bcc728,0x7ffcf2bcc734,0x7ffcf2bcc740
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,17926447928186866156,14265660697601479982,262144 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,17741318969097642751,16918721235397128897,524288 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,14111104609538653049,8878765070953186639,524288 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,16149458872641822160,854526409337916425,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,3135003631377172559,10079945232925835306,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,5906275092521769562,104261441819403681,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,9399134307025166377,4768014087922376151,524288 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,1012153604970437485,4643728478534749851,524288 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5468,i,5240054751616546356,9209055267992013148,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,9928777202456805625,16769663702124627008,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5844,i,15457170114674391970,14978286126197303474,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5812,i,12859037549472221316,11646267896043818588,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6100,i,16341311940860669441,4052743518579914436,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5848,i,16540356386761379559,11808452766094967719,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6092,i,1231155294984165381,17242857230786455018,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5564,i,16251156255900603440,9793207701107015021,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4996,i,6582836891242178549,1908172822081619584,2097152 --field-trial-handle=1936,i,13841554664586273895,18169626293408187421,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 6ade8d4a9e805129f431fa5f16d81402067ae1e70c5432732ad088bd1c60fa31
MD5 16a219e56a232d70bcdb5594cdb53c83
SHA1 11fd6b07ec6e5ffd58a47063f2df1de57b23017c
SHA512 9d6f53fb009a29561f733475a57fc88ec6ca2519b6055b8a38721a17bdc77189c2dab54747b1beb1926b8aa074ec9367897fb72b56201a9ddfa47afc51ad11bf
TLSH
T12FB02200028200C8CB000AB00CA20C823CA08FF82C23E28383C280FC88323F28FA0A02
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f87dba3bc6cf5f9e59a75fac70f96399552978eaf81674698c947f5263c52a09
MD5 50a43e5c136515f6028ac5564e0622f1
SHA1 6c3cf86ede2fda80ce0f2faf37c829c63f8bc908
SHA512 d11522175ef49dc961e2a057eefda616aa5fe3163e07da3cac1dd2641692bfd30a74a1d1cd8aa0ed7dd9b09f6070824f63e4bcfb20f289867c28f323b43ab83e
TLSH
T1D2518CF7D3E4867D841156F49B216E1FCE6D0A28021C3C6AD8E8AF5B97E2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 ecd6d21d59ed761e49b892a406391eb870edff39fbb1db18bcee1fc5d0cd8050
MD5 ec7a0e35ff7b7267d23d51f9b8e6f01b
SHA1 97a9ab5b89cefbd84df087dff8b488473b4f4f6f
SHA512 cf4d31ae8c657365b44dec2caf4e2f581f978fbd1f0871ac606246b72f79f5f90a7ad67fe023d3495cf42a75595b300f965b22cd4a6465d4bdcfc5cf5eb21fd6
TLSH
T1E1F059E7A66A746360BA097F4E05BC0568B5A83515A068F8EFEB437CD0824E70B03843
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1e574b2c2f8d271013ad455dc6e47a8321a7d913ad0a8218e25e87e3f7fd9b3e
MD5 8cb7e2d71f12dccd164c4d2a1943afaf
SHA1 3c337be0687a509186c217412f159913e66709aa
SHA512 61eaf9a14354924cf2ed7685b1b6b66e3da3300a978b4836a5048e1b443dff3faa2bc248a3851c2a1b5d4e541d999ebfa2fb43b3a0bc05ea992a89f87d7a719f
SSDEEP 192:tRZIaD3v7pAPRp2tNrS9XxHsb+WNnyw4Sox2KFLva75fxVyIsnAUge:tRZIkfAXTfwVa2Oahe
TLSH
T1D442B72ABA10B93B6DCAD219FA527653D7F6102124D42E84EBFCC93C15E75CC622741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f8eb8710076dc96b12da7eec1237745c02925b630105accaac200934025bb8f6
MD5 4eee011019011edef914149dc038c7f1
SHA1 23d53048d83cf49884717222f39724acfad9c083
SHA512 99b2ca644b1f88d23c028c54f8dc17170fbeff94fd1db966180ae2b1727a0e8a6d337ae16b4bf05a499421824cad16bab4cc10d8c7f9b474cd826c363158c399
SSDEEP 192:tRZIaDBv7pAPRp2tNrS9XxHsb+WNHqyw4Sox2zFLva75fzPyIsnAUge:tRZIkRAXTfw8a2FaBe
TLSH
T17A42C82AB910A93BADDBD229FA527753D7F6102124D42E84EBFCCA3C01E75CC621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c456a8344aa17015a00f856a73004bbf6f1e82e0e2b14214148fd2825d8e3491
MD5 cdedecab4205668f64aa4703d097402a
SHA1 d01fa460f47645969695aa7a6965c906c3872f21
SHA512 db6eb0fab648a6957201ef325c745329fb3646509aaea5ce0216d49732a03a9ac3bea2c9f7dec5fbde257677ac2bd57a5cbf7019f711c2ad3e106a031096eb7c
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5CmDDB6nGyvn0b4T8XybJv4a:xC0ITo+TQ0InDUDJdPPb4T8Xybl
TLSH
T1CDA10835A0288DB75476D446F1622A43CFB97067E972AF90EAD90E0D15F70EC1341A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 3533e061068c974f56b766adb1bbf50b32a083a7164f929808bd074b467f1d59
MD5 46358810c379548d541da4943afe8c16
SHA1 aea266f60191ccfafc2221d4783d63c0ea22267d
SHA512 8dc863c16a078867bf7cbfe3d03620f6d9b10d7e22a2307e026607c7d2f82518606683a0a4bc8b4f480f2c3908e8850808bdc4ea5b5234f61e6e223c3e8663eb
SSDEEP 3072:ip0YTXN7WTnyFGDj+f0nQJJQ/9DGg6GzuwVTNegth/FbYWf6t75KFn1C:i6sdWuAv+cnQM9Hzzux+h/jSl4Fn1C
TLSH
T1DBD312403DC61DBB00E9EB19A01B221EBFF4407759C1A74DDAC2BBC99BED851C35B869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 e707511e478a537662dd664f44d9f76136751302f2e3cdf0c2241241be2b1c72
MD5 9d1238a11a43a5e7e18a002c5b2e628a
SHA1 fc40391a6c4897670213a2773f2f531ce02210b7
SHA512 44ee6348f6bc59e40474b41df7ff6df0ce6403067aed5fa2cb6156383f4304f860c1c3dcb0169f3a9892527f7cbdeb3cf75cf6bdad7e1b8e446c83ad82c4f251
SSDEEP 3072:0g0YTXN7WTnyFGDj+f0nQJJQ/9DGg6GzuwVTNegth/FbYWf6t75KFn1C:0lsdWuAv+cnQM9Hzzux+h/jSl4Fn1C
TLSH
T159D312403DC61DBB00E9EB19A01B221EBFF4407759C1A74DDAC2BBC99BED851C35B869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-189-0x000001C026460000-0x000001C026523000-memory.dmp

Download

memory/5260-0-0x00007FF64A310000-0x00007FF64B589000-memory.dmp

Download