5f6632077f1d765608ea8565eea8221b2968975fce677df13a8ca374dc9d0224

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VSpoof.exe
Size 364KB
Sample260802-pgmlhsam3s
SHA256 5f6632077f1d765608ea8565eea8221b2968975fce677df13a8ca374dc9d0224
MD5 cdf297081799b23d8e6239ecbc4ef3db
SHA1 f99165a8603f07b55f60442b82be47abe737be9b
SHA512 6ad889e78d5cd0ffa6cfe133361d4b2e46a13baa7ef942da11df99fb8e98042d5f83db146a599c46421fc15ebb7d78dae0ad37ee86f48bc2bd7f3d3eb34ac073
SSDEEP 6144:2gzQkwOcr5AAunF3AUiStzPd1kJcW77slHUyGk:Pkk4r5ArFikFyz7IV
TLSH
T15C847E26E79504FDE1A7D179CD924842EB727C4E03A1AADF23D049961F276E08F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3612	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301467718590938"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1208	1724	chrome.exe	96
PID 1724 wrote to memory of 3612	1724	chrome.exe	97
PID 1724 wrote to memory of 3040	1724	chrome.exe	98
PID 1724 wrote to memory of 3040	1724	chrome.exe	98
PID 1724 wrote to memory of 748	1724	chrome.exe	99
PID 1724 wrote to memory of 748	1724	chrome.exe	99
PID 1724 wrote to memory of 3168	1724	chrome.exe	101
PID 1724 wrote to memory of 3168	1724	chrome.exe	101
PID 1724 wrote to memory of 4172	1724	chrome.exe	100
PID 1724 wrote to memory of 4172	1724	chrome.exe	100
PID 1724 wrote to memory of 3704	1724	chrome.exe	103
PID 1724 wrote to memory of 3704	1724	chrome.exe	103
PID 1724 wrote to memory of 4504	1724	chrome.exe	104
PID 1724 wrote to memory of 2524	1724	chrome.exe	107
PID 1724 wrote to memory of 2524	1724	chrome.exe	107
PID 1724 wrote to memory of 944	1724	chrome.exe	108
PID 1724 wrote to memory of 944	1724	chrome.exe	108
PID 1724 wrote to memory of 4616	1724	chrome.exe	109
PID 1724 wrote to memory of 4616	1724	chrome.exe	109
PID 1724 wrote to memory of 3644	1724	chrome.exe	110
PID 1724 wrote to memory of 3644	1724	chrome.exe	110
PID 1724 wrote to memory of 4608	1724	chrome.exe	111
PID 1724 wrote to memory of 4608	1724	chrome.exe	111
PID 1724 wrote to memory of 568	1724	chrome.exe	112
PID 1724 wrote to memory of 3976	1724	chrome.exe	113
PID 1724 wrote to memory of 984	1724	chrome.exe	114
PID 1724 wrote to memory of 3688	1724	chrome.exe	115
PID 1724 wrote to memory of 3688	1724	chrome.exe	115
PID 1724 wrote to memory of 2624	1724	chrome.exe	116
PID 1724 wrote to memory of 2624	1724	chrome.exe	116

C:\Users\Admin\AppData\Local\Temp\VSpoof.exe
"C:\Users\Admin\AppData\Local\Temp\VSpoof.exe"
1⤵
PID:4304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4a3cc728,0x7ffa4a3cc734,0x7ffa4a3cc740
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,5486216120817518642,75031754500447038,524288 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,9130809358584912646,8846009897496970270,262144 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2460,i,17668566197000431367,7751983496398908352,524288 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,11974103112846546033,12630472725153199472,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,1157894123233931435,14290966087965058792,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,3788623282880736142,15148996251294887344,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,17939950578952518514,2383219697778289718,524288 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5684,i,6888670531556263451,5839477049739437415,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5712,i,3863929098865015531,744354367422788036,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5864,i,2182007583858674852,17124811458127926147,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5940,i,3537016976798595379,10949505993887053848,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3364,i,11089283337086014162,4646508962885679009,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,5189733442230270509,18195029667698871345,524288 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,11975480039581932785,11109718366422014124,524288 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,13750919752605444347,5795252490659084248,524288 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6308,i,730464016494456506,11304182526078455510,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5268,i,17941159840787044747,5701069708586846203,2097152 --field-trial-handle=2152,i,15940766894977399556,12706936502024651769,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1460fdabec2db93c5ec42a36c749fff7eef35ff40a4e5e2fccef6658fa4adb7e
MD5 44fa5fb83f255886dd861a3b9c399c3d
SHA1 9e5153be74d2cbbd1e38351567c6f853c197a5da
SHA512 968a9fb642c90dd03f4ad31b338db6ece98992305a47adbe4e33a6bb9a3f166644f6f39a444d8f8a9ff47b239f6d05142d5766bd2ed9ef9d30c7a3b652d41eb4
TLSH
T17DE0E5AAE922AC2719F9072C50900B46E64013972F41895F373C9009CFB563A114981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 689a1990563e82b5056c86003c44eb74a7324e6db9e54e6aec7ba6000118dedb
MD5 6d918f25ebd5176c97fbff632f4f2c99
SHA1 ad87163bdb913d91cfe978e74108b08dc72b24a7
SHA512 852ae6fd66e4dd29b8699b14a482bb2a607cdc6f6cb7ab5fe7660c17e8efb366b04cb15320045e4117ef0563c156f2cf62d620a567593a1b0427998bd45b0d5e
TLSH
T1612163B080DC4595DF96267A3CD17E14B631E00A9AE39FC300E99534C40FBFA84DD487
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 81fbabc7e4b5562228e9de33eccbd4e7f9fee03bf6df1f503e14b00e7bf8e91f
MD5 09ec5394125c4840c4af602ff1a1caa5
SHA1 fb838dce7ec900580d4e2882964331258b5bf43e
SHA512 a2ec549ff8e9012adb92b285986dc9d250da67276feea272f89d6d5f2069554bf1b0f87c7df25c9b5d636e9c7ee46312b796e49ca54e152d43fc0e9ee40cfe92
SSDEEP 192:DsN3jJhJg2JAewRaIIkDq7jIbkHjPjBjcjqmgUhq+3ANz7KB/gji/faSjJI7qNfS:DsN31Pg+Ae4aIIkDq7jIbkHjPjBjcjqV
TLSH
T16132CFF3C3F49A2D8C2155F4B6122E2BCE6A09145B2C3C6BC9F56F1BA3E1471E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6da0279883eac20da1c1de26aa4c8ed66e50f4d66d42b7b6aeaa9b7f47b44151
MD5 b94b6015e7aa4c6b728564814475ba76
SHA1 f287214d959a36b53a8567fb2961faf6156d5205
SHA512 9545e69962c95325a195a5ecbde27271bd6657e2e27579d0c4d0c3a2c6e3c8905218010c2aca5f1fd8c9db963b2361c9e7de817996a191f0d60440632d73cbdb
SSDEEP 192:3RQAxs2Mv78pAPRp2Ix9DHsb+WNnlxaVh2bkGv2nenDuVyIsnAUgtaJ:3RQAPY4UXF5wPy2oGv2CDm8
TLSH
T1E542C52EBA10693B5CEBD219FD667B67D3F3102266911E90EAFC892C14D75CC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f5638ac145701334613bb9dea85fc69899f401d7c754e8c805c49d1a7a0dc58b
MD5 d5b14f69866b6cf177f5a3bb2a4c7b80
SHA1 8227798c6895b36dddf99bbce2ce7f7cd1d48bea
SHA512 9a3f83cd2bf09df2927b340aa250a4d484f713c3281bd3a4fd04ae50375825b308937de1e4f4f9a7c465a0dd2ff15efac3a3987870ddc86d27e7f8cf5f5e6bb2
SSDEEP 192:3RfAxs2Mv78pAPRp2IS9DHsb+WNnlxasAeekGv2nenDdVyIsnAUgraJ:3RfAPY4UX+5wPae3Gv2CDre
TLSH
T1F642B62EBA10693B6CEBD219FD667B53E3F3102265911E90EAFC892C14D75CC322700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f6e1d0d4590eadcd28e9006a49ec342fa08c1e0221afb53d5dbcf077d934f195
MD5 253119438d92ac4972d7395b5f7708fd
SHA1 bb43a52f7f7755823e38c39afd3972a7524c9052
SHA512 f2481c02e0817ae2c9604cf1c1d65cf0316abad480230a800879502c4f0c3a42aa734554fec5d53485876adad123293da6c4096aa17ecfba7709546aefb88972
SSDEEP 192:3RfAxs2Mv78pLPRpDIS9DHsb+WNnlxasAeYkGv2nenDpVyIsnAUgraJ:3RfAPY4hX75wPaeBGv2CDPe
TLSH
T14442C72EBA10693B6CEBD619FD657B53E3F3102265911E90EAFC892C14E75CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 70b3c14591149853d7a716b6614f9e8e9cc86613aeff25d23cdad08a8c15109b
MD5 33797ad94fcb8077fe1db19aa459c47f
SHA1 9fdbad013a653d7c8ab543b3666c30cbbfb3238b
SHA512 da874dc7f01b67ebc1903afd5cb233ddce6a380369627c3048de7383c394cf97146fefdbf44e1c9b3b6909ab98ba615ed87ca08bd27fbc4d3e5d4642f666bd75
SSDEEP 192:3RQAxsdMv78pAPRp209DHsb+WNnlxdvkGv2nenDuVyIsnAUgtaJ:3RQA0Y4UXD5wPd8Gv2CDm8
TLSH
T1AC42A42ABA10693B6CEBD219FD667B53D3F7102265911E90EAFC892C14D75CC322711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4d28531bc3c23285c9089951530fbc0cced820d1fbfc9868d6b8be9915fdb054
MD5 6dc4c13a5563fb93fcccf28deeb677e7
SHA1 f0273c1420a458aadfd921b9071ade7430750507
SHA512 5c05a0030d15b9e9b28187ec43b74e051335e1617bce64944e7a068d2d22ef93c85b59653d6e44d732e48354ffac84a2c8733c7dfd841deffe9e9af95995f3dc
TLSH
T1F7A0026E05407061C06C4B712BD98180B7218C10134B225544D7884DC8587C34641A85
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 ccf56eb454c3c874bdcc51f71761b1f1b0cf9f281bf53cbdb27259d5f9c708e6
MD5 d234578834a9b5f2807f10c849dfe87d
SHA1 a5467d0275c5eff09f3930680a0498c0b5e4852a
SHA512 3ebddb16d9e8806cfa863ec9a1e6b40de18069a16806825386542ec3328604cc3afbb788c3d23ea64fef433d278ded5dcf095d4d2198e6e6c0482209b29d1f1a
SSDEEP 6144:BuOWzFmKQGJub0l6LG4rIlJm7Rkm1tYpBeh2BAoG:BAFqgCGeh9oBGcAoG
TLSH
T17034123FBD10D8799A68BB1D708E570F1DF1D0E28A64D6924DC0AF053FAAD490E09E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b39f33e3db6258c80c6f735fec4534964e5647a88e979d425c9b10c9d988a608
MD5 e162d3b0de6a3a96c1b8208829abe0bc
SHA1 4256c262b258fb2f5badfb8d29752d81ef9058bf
SHA512 ec03637591c5310d9a7abdf02928d09900b8260bdea5d40fd957ef7999f2e52adf1510c762e7cf8ed3891240c19459bae571353a5b52f20e6f7c85d9bb4b2591
SSDEEP 6144:OuOWzFmKQGJub0l6LG4rIlJm7Rkm1tYpBeh2BAoG:OAFqgCGeh9oBGcAoG
TLSH
T1AF34123FBD10D8799A69FB1D708E570F1DF1D0D28A64D6A14DC0AB053FAAD490E09E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0d95995e1b73b31fe2fc829ccf1535c7419ca719455db3b47b881be9c0053e96
MD5 26d59ada0bc91fd22992f2b25dab4d71
SHA1 ca6d6f5988363bbad7a46571c5ddaab4522631f3
SHA512 0d041009fcceacaeecc744cc3945c8d6c86f0f116be027c6981fb857eb273072d4ccbd6584e3d78f00041df3c46ec1357dd46e7882d2e7a28a0ff293c15f61fb
SSDEEP 3072:XGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Wm7Rkm1tYpBeh2BAoO
TLSH
T10BC3123B5D65E9375D79A71EB48E0B1E1EF24DA6C930DE42C8D46A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 1e123ad92288d69a8e7b222251944e51907c19ffe69ca105658e3897b6a95b83
MD5 cba6004d85e6a346053222ca9d322e1d
SHA1 1db6f58addb856c3a49b388cfe6d719bf31a8b3f
SHA512 32aa962e2dd8376df52e4402ec12a08ff8d5c8fbed9d07f039a8e0fe41db5bd808e6ab09b94df7067727bb1f5d4e70bd5fbc2ae2d4bfbc5bb991c2ddd7d40e20
SSDEEP 6144:91YOWzFmKQGJub0l6LG4rIlJm7Rkm1tYpBeh2BAoG:n+FqgCGeh9oBGcAoG
TLSH
T11734123FBD10D8769AA5BB1D708E670F1DF1D1A3CA24D6958DC06F043EAED094E09E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download