Overview
overview
8Static
static
3VapeV4.exe
windows10-ltsc_2021-x64
8$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDIR/app-64.7z
windows10-ltsc_2021-x64
1LICENSE.electron.txt
windows10-ltsc_2021-x64
1LICENSES.c...m.html
windows10-ltsc_2021-x64
4chrome_100...nt.pak
windows10-ltsc_2021-x64
3chrome_200...nt.pak
windows10-ltsc_2021-x64
3d3dcompiler_47.dll
windows10-ltsc_2021-x64
1ffmpeg.dll
windows10-ltsc_2021-x64
1icudtl.dat
windows10-ltsc_2021-x64
3libEGL.dll
windows10-ltsc_2021-x64
1libGLESv2.dll
windows10-ltsc_2021-x64
1locales/af.pak
windows10-ltsc_2021-x64
3locales/am.pak
windows10-ltsc_2021-x64
3locales/ar.pak
windows10-ltsc_2021-x64
3locales/bg.pak
windows10-ltsc_2021-x64
3locales/bn.pak
windows10-ltsc_2021-x64
3locales/ca.pak
windows10-ltsc_2021-x64
3locales/cs.pak
windows10-ltsc_2021-x64
3locales/da.pak
windows10-ltsc_2021-x64
3locales/de.pak
windows10-ltsc_2021-x64
3resources.pak
windows10-ltsc_2021-x64
3resources/app.asar
windows10-ltsc_2021-x64
3resources/elevate.exe
windows10-ltsc_2021-x64
3snapshot_blob.bin
windows10-ltsc_2021-x64
3v8_context...ot.bin
windows10-ltsc_2021-x64
3vgcbypass.exe
windows10-ltsc_2021-x64
8vk_swiftshader.dll
windows10-ltsc_2021-x64
1vk_swiftsh...d.json
windows10-ltsc_2021-x64
3vulkan-1.dll
windows10-ltsc_2021-x64
1$PLUGINSDI...7z.dll
windows10-ltsc_2021-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
24/06/2026, 08:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VapeV4.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app-64.7z
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
LICENSE.electron.txt
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
150 seconds
Behavioral task
behavioral7
Sample
chrome_100_percent.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
chrome_200_percent.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
ffmpeg.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
icudtl.dat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
locales/af.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
locales/am.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
locales/ar.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
locales/bg.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
locales/bn.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
locales/ca.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
locales/cs.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
locales/da.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
locales/de.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources.pak
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/app.asar
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
snapshot_blob.bin
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
v8_context_snapshot.bin
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
vgcbypass.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
15 signatures
150 seconds
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader_icd.json
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 8.8MB
- Sample260624-j1a4yaaz21
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- TLSH T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4868 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267623613734006" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 820 chrome.exe 820 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe Token: SeShutdownPrivilege 2868 chrome.exe Token: SeCreatePagefilePrivilege 2868 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2868 wrote to memory of 3460 2868 chrome.exe 83 PID 2868 wrote to memory of 4868 2868 chrome.exe 84 PID 2868 wrote to memory of 3376 2868 chrome.exe 85 PID 2868 wrote to memory of 3376 2868 chrome.exe 85 PID 2868 wrote to memory of 2640 2868 chrome.exe 86 PID 2868 wrote to memory of 2640 2868 chrome.exe 86 PID 2868 wrote to memory of 2164 2868 chrome.exe 87 PID 2868 wrote to memory of 2372 2868 chrome.exe 88 PID 2868 wrote to memory of 2164 2868 chrome.exe 87 PID 2868 wrote to memory of 2372 2868 chrome.exe 88 PID 2868 wrote to memory of 4976 2868 chrome.exe 89 PID 2868 wrote to memory of 4976 2868 chrome.exe 89 PID 2868 wrote to memory of 4460 2868 chrome.exe 95 PID 2868 wrote to memory of 4352 2868 chrome.exe 101 PID 2868 wrote to memory of 4840 2868 chrome.exe 102 PID 2868 wrote to memory of 424 2868 chrome.exe 103 PID 2868 wrote to memory of 820 2868 chrome.exe 104
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd4c0dc728,0x7ffd4c0dc734,0x7ffd4c0dc7402⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,8120486228099879723,17494521641567299716,524288 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2208 /prefetch:32⤵
- System Time Discovery
PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,11295606594907166641,11581062868414536301,262144 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,60323033024818476,5720653141038869370,524288 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2524 /prefetch:82⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,2643834644385171916,6203081012456460526,2097152 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,8484468555460192370,4953423272619183440,2097152 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4252,i,11244961268291140181,3075213252045915670,2097152 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4264 /prefetch:22⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,4914068312373168183,2030535884710022953,524288 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5364 /prefetch:82⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,4614716812388412296,14109504387163068684,524288 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4824 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,13452238626281107808,14694054357817073401,524288 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5512 /prefetch:82⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,14999421035746580363,12254957998609040310,524288 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5612,i,12112278844252966041,7273338842807761667,262144 --field-trial-handle=2168,i,9500148762350060398,11009897003505581749,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:820
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8bdf6d7e-a188-47b4-b371-1be54652a64d.tmp
- Size 12KB
- SHA256 0d5f67261f815a7eca14f1ab48326e8bb315ecced248310917e5d406fd952b24
- MD5 97a5226d47482de9f53ccf6951f2e0bc
- SHA1 88c5b4a1b4ee046bd6315d4e5268dd4613a6a9ad
- SHA512 49f3ad96786b23a221353c856f9bd5aff99a1448d8e7818dcbcf6190950128026aab5a3352288a5951d65682b4c19be48a302fab1fa39379d8a4932b0a742b24
- SSDEEP 192:cRPHG9rsAwfpcZApuAmtaV9btv7SVpAPRp2gl9fHsb+WNnOZPO42kwwqVyIsnAUp:cRPHLAGrMUXfxwsPr2Xe
- TLSH T16142D66EBA14657B9CDBD62AFD617713D7FA102222802E84E6FCCE2C15D79CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 cf1801720a0e61dbf4a43b225a8f78efeae9f1ea097a0848ae8f4648d261a30b
- MD5 e9f2b3b5c3cc0ef1e073578e3455c3d2
- SHA1 0b3ddca9adcade7ab2840b9c440636d9b2175a32
- SHA512 c06766dce30319b04c79128c37ea7ed7763dc9b4d35dcc1c320f6f916af3ff7df83b64f6a06de585ae41f315fc03e11ad18d5056b03220854f82138f989f8d6d
- TLSH T1D3E02BBBD8619C374DFD4B2961784686F79113172781994F7A3C820CCFB5A36019785C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 c560d5f06525139cb6b29712072dc86749a33fab2a7f81d1a94f2f2decf69074
- MD5 bbd703bd9ec3770424917a6ad2ea09e2
- SHA1 494e449db6091ac3aa7f75ed85f6f67055069822
- SHA512 9be753fcbe1644ad9b347c025daf4293425213410132eafa132ed0cdd58cb6de03a4e241e0331803dca08eca5d590627800fc61c89bb92e46a2ef43994baab13
- TLSH T168419BF793B4857E8A1192F4EB15AE1FCE690524531C3CA689D4AF1B57F2872D20078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 12c953d824d37f2911dece87103645968222d9440f29f0d4f503a292fc62cc14
- MD5 8d40a55c044a409a3488213d4c91c2a9
- SHA1 cf6f49fbb3de63cba584e9bd584a420697544d48
- SHA512 0f7d83d8ad6d49266f4904431223e6c856416b39fdc32115a3205c68931e62ac858d782bb72c771b682f49270200b3d3a976793f052b5bc6798b7c7c5568d410
- SSDEEP 384:Zfjd07KxkXqKf/pUZNCgVLH2Hfgsl/X7pLuLcSjrGXODd8+ErU3HYHGt64PH:Zrd07KxkXqKf/pUZNCgVLH2HfgspX7ps
- TLSH T1D372F8676C4C9E3B4FD4C98CD8267B4FADB5014B25D9C86883FA982503D5BDF11062EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 cce95d335f26dd4bce0456ab085ba17c8b5ac0ce36322bebff52bf07146953a8
- MD5 cdf60715c19d971fe7fb36df19855bc6
- SHA1 2b11c921b7d496191b6256db1ff7f0013741efd8
- SHA512 b7a14ffcd015c34bb46d5c264674e2e68b38cd13161db88dde977ab804cd8b289b3a5d96219e4c7c5ff3d07504861d5a45c62b2206c323bf713ac7300dd46a41
- TLSH T1BCB0128180415102C04602F01256148C71145F14AB0B370243E46927D82526384150A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b6b8.TMP
- Size 96B
- SHA256 fc4197ddf54e53709ad4a4791f6a5f64bb231d3bbb97e6f14d2925e7e595fec0
- MD5 8895235235765a34068a293ff700ad18
- SHA1 a5bfe8a4de136e5fc5c363faa259eba36a4e359d
- SHA512 c015d435a207a5a58aa8d7152d746783d464f8f5cec8c97729f61a5cf6eb7682f0fe2fd7dd7fedd249e798f624f5c2a8fcae29f95ea6d7a52283b895b5686091
- TLSH T16CB02220C0032B03C08203B032888CCCB020EF20C2030202C2F00A22CC20232003F030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 1cdbf761ab441204e4b8f7645e19f9a54321f2eea6484882d407bfab4b0580aa
- MD5 e5f1b420e3b075c16be372f0d971ae5a
- SHA1 59c9a1a026b47d34696af44439a653f2a187ddd8
- SHA512 12900d3b67f3555125bb28cbdbde279ba7f4cab17768bdf7a04b7b8048f7c5f68c63b09680c649fa26dcdece92d1704aa806192b821b12685b9950f8cea8dcb5
- SSDEEP 3072:9uw3LffUnBKU/F8enCW3iyVEXGey0cB1W:9d3LfqBZqenbyyVEd1cB1W
- TLSH T1A0C31231E49AFE6763A9573BB40B931A5CE149BB84D1B788443C2F19D0CA2C8FF99D44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 151KB
- SHA256 e510a73a9912149d065c30656494ef3c0bcc5547ad1c615612d27f31f12e40a7
- MD5 a39230cc20fc876840a0ecc7e927fd6c
- SHA1 a7e96fc5d670ec021c67f0247fef5a48baba0d0c
- SHA512 da49c0c78886f222bcab6860c4898c5be9b0c9fba0823497e2c53db518e9f55e6de3cc9faf49b4f7750c2c0a8e2632e954e76aff9eb75d2427e253d8d41db9f0
- SSDEEP 3072:D0wO8o/SYeViw4NERw3LffUnBKU/F8enCW3iyVEXGey0cB1W:YwOr/hwdO3LfqBZqenbyyVEd1cB1W
- TLSH T138E31232F4A6FE2E626DEA297047A7194CE149BB44A03BC4047D3F5990CA784EFDEC15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 c1bd4e30f983aa04ca182d33742f94f5d1e009e62d50e29ad5b250abdf9240c7
- MD5 2225651b8d7fc48e071742ddde460dc5
- SHA1 da30c4c23c0d33af826ae4a192e52b11593701fd
- SHA512 4b3a1af1eb00ae09e3186ef62e59f456df3941114fd06346a8fb6066bcf32137d13a65ba3fc5fe51296b28a41e1ffad046e5cb5925f7db7f938f93057468ff80
- SSDEEP 1536:MUtSwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/QW:gw3LffUnBKU/F8enCW3iyVEXGey0cB1W
- TLSH T177B31231E5A6FF7B6369562A750F93191CE149FB44E1B784443C2F19E0CA388EF98C44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e1380357-83d0-42c8-b7cb-14c92119786b.tmp
- Size 116KB
- SHA256 a60465d0cbaae211dd9f7033c921550dc573aaa8bb9607043dcced20d967d844
- MD5 679d785051c4ca1ab6bb9857cad390af
- SHA1 bd5d6440d51349e062ddc6297cbb7387fb76df3c
- SHA512 d0d8ee9b275452f309fbbab5e640ace2afaf21048d3943b7e508b3a06237d27cbf8b5a553117d34156dba1d963fdc68bd81603d44903692e67e96d5a46c53d04
- SSDEEP 3072:Cuw3LffUnBKU/F8enCW3iyVEXGey0cB1W:Cd3LfqBZqenbyyVEd1cB1W
- TLSH T131C31231E49AFE6763A9573BB40B931A5CE149BB84D1A784443C2F19D0CA2C8FF99D04
- MD5 SHA1 SHA512 SSDEEP TLSH