Overview
overview
8Static
static
3Xeno-v1.3.60.exe
windows11-21h2-x64
8$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows11-21h2-x64
3resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows11-21h2-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...rt.dll
windows11-21h2-x64
1resources/...on.mp3
windows11-21h2-x64
6resources/...se.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...b1.dll
windows11-21h2-x64
1snapshot_blob.bin
windows11-21h2-x64
3v8_context...ot.bin
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vk_swiftsh...d.json
windows11-21h2-x64
3vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
900s - max time network
883s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/09/2026, 08:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.60.exe
Resource
win11-20260911-en
windows11-21h2-x64
37 signatures
900 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
resources/public/concrt140.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
resources/public/index.html
Resource
win11-20260911-en
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral16
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
resources/public/libcurl.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
resources/public/libssl-3-x64.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
resources/public/msvcp140.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
resources/public/msvcp140_1.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
resources/public/msvcrt.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
resources/public/notification.mp3
Resource
win11-20260911-en
windows11-21h2-x64
8 signatures
900 seconds
Behavioral task
behavioral23
Sample
resources/public/ucrtbase.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
resources/public/vcruntime140.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
resources/public/vcruntime140_1.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
resources/public/zlib1.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
snapshot_blob.bin
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral28
Sample
v8_context_snapshot.bin
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader_icd.json
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260925-ke5bbstcka
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3236 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348000652008249" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4404 chrome.exe 4404 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4576 wrote to memory of 3796 4576 chrome.exe 79 PID 4576 wrote to memory of 1864 4576 chrome.exe 80 PID 4576 wrote to memory of 1864 4576 chrome.exe 80 PID 4576 wrote to memory of 3236 4576 chrome.exe 81 PID 4576 wrote to memory of 2744 4576 chrome.exe 84 PID 4576 wrote to memory of 2744 4576 chrome.exe 84 PID 4576 wrote to memory of 3452 4576 chrome.exe 82 PID 4576 wrote to memory of 3452 4576 chrome.exe 82 PID 4576 wrote to memory of 4928 4576 chrome.exe 83 PID 4576 wrote to memory of 4928 4576 chrome.exe 83 PID 4576 wrote to memory of 228 4576 chrome.exe 87 PID 4576 wrote to memory of 2692 4576 chrome.exe 89 PID 4576 wrote to memory of 2644 4576 chrome.exe 90 PID 4576 wrote to memory of 4496 4576 chrome.exe 91 PID 4576 wrote to memory of 4404 4576 chrome.exe 92 PID 4576 wrote to memory of 4932 4576 chrome.exe 93 PID 4576 wrote to memory of 4932 4576 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4c7ac728,0x7fff4c7ac734,0x7fff4c7ac7402⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,12129720780042582029,4864577441904662678,262144 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,4104290779524111167,13513854655002570709,524288 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2224 /prefetch:112⤵
- System Time Discovery
PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,3173389973773681537,14011748177183890561,524288 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2744 /prefetch:132⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,2595384732878930825,9513910795817504380,2097152 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,7604310184553972903,8859061096414878511,2097152 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,11942203670823426883,4823100990503442061,524288 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5180 /prefetch:142⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,3209375515456131296,16833196371600319656,524288 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5440 /prefetch:142⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,16799807337975197265,13354186831574909089,524288 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5280 /prefetch:142⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,3300290629427775356,7412099366899702239,524288 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5296 /prefetch:142⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5512,i,205578697512012667,12799185920609739699,262144 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5292 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3988,i,16877888211155984245,13021594034606574504,524288 --field-trial-handle=1944,i,9795251349496673888,16468191616641071523,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5392 /prefetch:142⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 71209804f9e46383f4dd769e3c0ba9d9c0ecafd057cbd21ae0e3f9168dae4207
- MD5 bfa6ff5a9a664bc6e9ab0ccd1ffa4c1c
- SHA1 c6befa101bd8adf32a3131c3a5d5ada0cb4f11bb
- SHA512 e60b6d0956276cdf0d89b2080f4b840faa7e8c855cd32d1b9e074c56b170bffe66e797c1a66bd52576d258c4282ce58e4561256e14ae936dc4c4df03a594123e
- TLSH T1FAF02DB5CD21EC7704FD1B2C30951B47E755136B2A40989F3A3C811D8F74A3B458586C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 c07c8ed485c083203b88489728e9f9f4e5a78a51906f715e93f64ef9d6868741
- MD5 5a7eb852d97ee177f34ded641b0caf96
- SHA1 d22ce789629445493539f640385c697b9214c96e
- SHA512 e6228c42e91b80076be01a0c07890f653f077b30f8fe7d320d33a3d88cf4fcca9853258bd85f6a2c0a4cce3b23ee5a4fee4d23173e9a0feb1dd8710e1ef17688
- TLSH T1582199F7C3D8823D894152F8A7156F1BCE2E0A18032C3C26D8D9AF5B97E2870E11469F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 2a29c9cc6926b999acf743690f6f0afc96f848c61472ecf0a42149ed158ad510
- MD5 c33de9e3f784465d632952071b50d23d
- SHA1 dfab02f5ad7c8bbbb085fce8daf0e196f88c0696
- SHA512 db3b5f81792a79711949ee88d6a7358147b7545d1f138b65c595b9de3564a8d5f275d7e667da914b39ca36d83f7dc994388e989e2479cd848de0cc39bb6a76a7
- TLSH T1C5217CF7C3D8853D894152F8A7156F1BCE2D0A18432C3C26D8D8AF5B97E2870D21559F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 a1c53ae136bfdb139ccc3e691660a441889902acf5692e55276bb8f8fee3ca8e
- MD5 14392889fd3a339701b90703a3e90441
- SHA1 54cdd2959891f08f5af63b7dfe88907f909dcd8a
- SHA512 ed23945a42a7bc75f0462b4e924eed99108c4b43698fbf29ad58cad6679d3de89b273e136f8362561d2f002e71e39bb2418277fbf602181e62219e0b6ba9ddfe
- TLSH T177218EF7C3D8953D894152F8A7156F1BCE2D0A18432C3C26C8D4AF5B97E1870E11459F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 6cec5dbe8a5317ad4b0a9f894de1164f0479eac8033ee76184e86304da8390d7
- MD5 98dbaa7bb6ed111ee880ac03747dee68
- SHA1 6397d7af14d2e066c70851d9c16f1e31f29dfb4b
- SHA512 237cc12cfc79a50ef71f221d40558208f3ac23063dff9db721eaa211343fd38c53aed113d7543f13c4ba6c117bea2ade3e58e1edf7b1dfa30b8fd658a21c0ba3
- TLSH T1D6E0D8A7D6B9747740AD55671E44B40566B4AC30124268E4CD5B82ACE1944E71A43413
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 725691489434c44a4bc537d90f8997d4558ec424f98eab3f503b7288e193b93f
- MD5 3c218c7d3092005f1d30a2e449922b8c
- SHA1 93363dc86e5017619db713db106d90f9465b4fe0
- SHA512 042992fe311bcd305f5f0555a4567b281d24514eb4d90ad8cff650c2a15f8571e7bb760f244c12d8f2826f0559183ed97d3ba4cfdba1a8d8ba929e1931252b91
- SSDEEP 192:BR/CnM5Q/v7xpAPRp2pA9qHsb+WNnYxPU52i3kwO6zb1VyIsnAUge:BR/kM2X1UXJswyPQ24uge
- TLSH T16932822DAD14757B9CDBD21AFA657B53D3FA102120A43E84EAFC8A3C24D79CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 28d16cc0fea3ee3f410814f037fd762c44611371ab3e42e8de9c63734a8839b5
- MD5 d1c591cfb778f30559ee4446419b78c6
- SHA1 a8f3dc69dc9356d14807da189fd361bcacafbacc
- SHA512 1cb830a00d0e7706b335bebd1e8081697eec500f7bf86e5a15ccf1831b91f3a80e1809670e8f90e8b89120d6033ac93c47788b1a1131310f35ef5d727362c77b
- SSDEEP 192:BR/CnM5Q/v7xpGPRpkpA9qHsb+WNnYxPv52i3kwO6bb1VyIsnAUgE:BR/kM2X1iXPswyPh24uWE
- TLSH T1C142A32DBD14757B9CDBD21AFA257B52D3F9102124A43E84EAFC8A3C24E79CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 abd6daa20de1a8efb404d2e6b18db3d1db5a951ea981436a8e6f2178407c092b
- MD5 42120140355b12765ba9657c841e9bee
- SHA1 ce7e475b4029003b3c935b546de18f510441386b
- SHA512 6409499e03bc29a98239958666ce4d65919525a1e2bc13cd4107305eb01fa9c78dc76e63347d2d793a993f53c024dd4ca4cf42079a1d37654c407ef10b4f465c
- SSDEEP 192:e9OI24K6vOIz7KxkXqK4I40pUZNCgVLHrKHfFKslHlOI/XzKD/qOIP+ErUkKNb7S:hzjdQ7KxkXqKf/pUZNCgVLH2HfgslgSp
- TLSH T18A32D927948D9E3F0FDCD509CC167F4BACB5029673684D2496FF9C0803A67CA514A6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 82709df2cd0b7ec855177a0ca68d937d796e522924a98ec8fc1d12bf274a4fdb
- MD5 3daca6031d2a3cf89f3651a847840803
- SHA1 fa725a100c567cf8139151e9e0995c68a170cbf5
- SHA512 0da4b755358b8221341d6e08cfdcb2d40541bd0b5352228276aa1b50d73b8babda282ab6e7b43eaf0cd0a7c30fbb440a2b534caff1dd78d3bb185bdbe4fca0a8
- SSDEEP 3072:ZyH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:Zit4fLJ0L6nGJxi3bzqapJjt
- TLSH T17ED302F0C1A06C7ACBFBEE4145756E948E71D5C649CDBE2409F98C4802CEA794A13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 8860daa98cdfc0fbfafba21a8babdae65b1ce36e8d73840a4e571531c2b6d538
- MD5 56fcb32aa3b7a81bd3d114a0e6512cce
- SHA1 cebc03752232dea41ffdd200a913545af7c85e05
- SHA512 597888b8b36ecdf9cdfa75abb3c51d74ff37e24529dfe92f2aea6176c2b25ed14fa334efd00181061bbffe5756c254c5d9201500716f4e7e1a64817a96284398
- SSDEEP 3072:FuH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:F+t4fLJ0L6nGJxi3bzqapJjt
- TLSH T12FD312F0C2A06C7ACBFBEE4145756E948EB1D5C689CDBE2005F98D1806CEA354E17E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 11807aa528011936243f20cfb2c1e678c1ad6397823eb032c129f270e74ebfad
- MD5 9f310cf875e0be6147d1fa1578076849
- SHA1 18b48040f8ab2a678c115d014706175bcf4e036f
- SHA512 419d69e8b05ad84b66019503f13d7356484fa5b366401273829908f920fd770b0327c83850bc14bf5499d0b2353ddb144fd264e7b17024f4803045d1db8f6af7
- SSDEEP 3072:+H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:ut4fLJ0L6nGJxi3bzqapJjt
- TLSH T12AD312F0C2A0AC7ACBFBEE4145795E948E71D5C689CDBE2405F98C0806CEA344E17E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 336144d999870bc59e125da70fea29f9ba58a77cda29f3401844dd3e883ac91c
- MD5 b73f1cd65c4e6365ef5fcb961974c6aa
- SHA1 4e9eee45387144b50e70f1078d21c8a277208370
- SHA512 8bfc7e3ac448bf10158dc5152fd49fb3802954b8f80c3ef56cf9efc0ca6c5776f1f2dff987d8dae1341e80f93eed8f476e856a8ef784b2b72344816c19a22061
- SSDEEP 3072:ByH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:Bit4fLJ0L6nGJxi3bzqapJjt
- TLSH T1B6D302F0C1A06C7ACBFBEE4145756E948E71D5C689CDBE2409F98C4802CEA794A13E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 27d22883360ecafb18370b0b892ece5e93de2afe7340ad69df62e43bab937727
- MD5 6a1226fcc9182cf8a7cfe6069692b8a1
- SHA1 5daeae42dd5d1828ac6f901415009cf752b94a0f
- SHA512 7aa1e1aab3da2ca961706279cb0cb570cc0e08da4672ab6abd827434fc09c8d00eeea1c96d1c3ee70486caeb23c99db99ea93c761aef8afaff8888c45a734686
- SSDEEP 3072:0uH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjt:0+t4fLJ0L6nGJxi3bzqapJjt
- TLSH T116D312F0C2A06C7ACBFBEE4155756E948EB1D5C689CDBE2005F98D1806CEA344E17E63
- MD5 SHA1 SHA512 SSDEEP TLSH