2a5c14e79a8677ff7d0d0b039ebb3d12be8976d97a5d5f43dc31a443e509b2c8

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:13

Target
VencordInstaller.exe
Size 11.0MB
Sample261002-j4lpvade45
SHA256 2a5c14e79a8677ff7d0d0b039ebb3d12be8976d97a5d5f43dc31a443e509b2c8
MD5 a2b9f1d2e08bd83a0d479a5a520e4c19
SHA1 f2e279513b3d1a817fc38f80fd2fa0d23e005d3c
SHA512 29044bac2e2a972debf86cb85ed1d4b2b4b48229560a3955561560068b7f750ab942282df416509056a3619ce9fd2941ba74fcbf3c601812ba375675630d1ff7
SSDEEP 12288:+VMrxQTmPK5lvPkbve34TZrHsYDu0bQiKf1q3/jrssq57XOF//kqBF6tviRQ5TWC:cTbS/ND2
TLSH
T168C68661A36364CFFF77407299075607586D388682E8DC7F0E988A7039F17A7E46A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	VencordInstaller.exe

C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:1448

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact