Overview
overview
7Static
static
3Xeno-v1.3.65.exe
windows10-ltsc_2021-x64
7$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3LICENSES.c...m.html
windows10-ltsc_2021-x64
3resources/...no.dll
windows10-ltsc_2021-x64
1resources/elevate.exe
windows10-ltsc_2021-x64
3resources/...no.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...-0.dll
windows10-ltsc_2021-x64
1resources/...40.dll
windows10-ltsc_2021-x64
1resources/...x.html
windows10-ltsc_2021-x64
3resources/...64.dll
windows10-ltsc_2021-x64
1resources/...rl.dll
windows10-ltsc_2021-x64
1resources/...64.dll
windows10-ltsc_2021-x64
1resources/...40.dll
windows10-ltsc_2021-x64
1resources/..._1.dll
windows10-ltsc_2021-x64
1resources/...rt.dll
windows10-ltsc_2021-x64
1resources/...se.dll
windows10-ltsc_2021-x64
1resources/...40.dll
windows10-ltsc_2021-x64
1resources/..._1.dll
windows10-ltsc_2021-x64
1resources/...b1.dll
windows10-ltsc_2021-x64
1vk_swiftshader.dll
windows10-ltsc_2021-x64
1vulkan-1.dll
windows10-ltsc_2021-x64
1$PLUGINSDI...7z.dll
windows10-ltsc_2021-x64
3Analysis
- max time kernel
149s - max time network
162s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
30/10/2026, 02:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.65.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
resources/public/Xeno.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/concrt140.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/index.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/libcurl.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/libssl-3-x64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/msvcp140.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/msvcp140_1.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/msvcrt.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/ucrtbase.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/vcruntime140.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/vcruntime140_1.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/zlib1.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample261030-cpybrsvwcx
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2736 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 4020 chrome.exe 4020 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe Token: SeShutdownPrivilege 1796 chrome.exe Token: SeCreatePagefilePrivilege 1796 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe 1796 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1568 1796 chrome.exe 88 PID 1796 wrote to memory of 2484 1796 chrome.exe 89 PID 1796 wrote to memory of 2484 1796 chrome.exe 89 PID 1796 wrote to memory of 2736 1796 chrome.exe 90 PID 1796 wrote to memory of 2232 1796 chrome.exe 91 PID 1796 wrote to memory of 2232 1796 chrome.exe 91 PID 1796 wrote to memory of 4944 1796 chrome.exe 92 PID 1796 wrote to memory of 4944 1796 chrome.exe 92 PID 1796 wrote to memory of 2104 1796 chrome.exe 93 PID 1796 wrote to memory of 2104 1796 chrome.exe 93 PID 1796 wrote to memory of 2488 1796 chrome.exe 95 PID 1796 wrote to memory of 2488 1796 chrome.exe 95 PID 1796 wrote to memory of 420 1796 chrome.exe 98 PID 1796 wrote to memory of 4324 1796 chrome.exe 102 PID 1796 wrote to memory of 2068 1796 chrome.exe 103 PID 1796 wrote to memory of 4212 1796 chrome.exe 104 PID 1796 wrote to memory of 4020 1796 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa36e0c728,0x7ffa36e0c734,0x7ffa36e0c7402⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,8583603726750778140,15425161619935033542,262144 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,17195163826105751168,1809362357794249918,524288 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2260 /prefetch:32⤵
- System Time Discovery
PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,3478972737872447297,14906265397626578527,524288 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2580 /prefetch:82⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,4121062705632676311,4690213136387580365,2097152 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,15255958464427249656,2789604893426333694,2097152 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,8744304496739771715,951820260871635065,2097152 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4452 /prefetch:22⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,10976812257662880103,717467435213096361,524288 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,7915538064425632709,1880320631870929763,524288 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5564 /prefetch:82⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,9211775736752812421,1647455536400335188,524288 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5636 /prefetch:82⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,11076381234069062414,18169139577522230635,524288 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5648 /prefetch:82⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5460,i,8738508566040184616,18376695191889615396,262144 --field-trial-handle=1976,i,3441985586033442423,2939312553870222845,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5924 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4420
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\522a01aa-ebf7-4e40-a80f-f993b79afe8c.tmp
- Size 414B
- SHA256 075591001f83b8deb4212b904d1c1a1384de49083e3ed24016d79b87eaa8935b
- MD5 0f58572d4151acd000d3493e4e1aaf05
- SHA1 29725ac2dbeffb75f2994396ece1c579c0b9d4ba
- SHA512 736d1c28891da7fc9da8e7c2efeb0bd657c761193ced568cfa69d1b5fa82409648bac32445c7b86e570312e122eddf605081827c489788f04a52c4a14b9049bd
- TLSH T197E0E5EEC921AC3715F907586064424BE705232A6B40494F373DA20D8FB1A37458186C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\52c0b6ad-cfcb-492d-bf81-ef7df37eacc6.tmp
- Size 17KB
- SHA256 bc874b5dfd433743339ca27fbc016d54b007fab3e56af9f017a931025cb0f537
- MD5 8d3394a14b12f06ecbe650f06b4881fa
- SHA1 d4c8ccc659c5c983f73adedfc2f5491607ac031e
- SHA512 5052397393a9e12e611402bc4ac104433e8a02a13f8c7f9236e7f653a48cb0a7aaac61660c212ab456241d0ca72e689c0cbd6c0186b51f3570b8c09ec3b374b4
- SSDEEP 384:K0juV7KxkXqKf/pUZNCgVLH2HfgslRU7pLuLceScdXODu1+ErU3pfHGeXTuxL:KYuV7KxkXqKf/pUZNCgVLH2HfgsDU7p0
- TLSH T15972E967AC4CAA3B0FD4CACCD8277F4FEDB5025A65D9886443FA982503D5ACB11061E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c144635c-7e0e-4f70-ad01-5146de1c95da.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\edc6646b-0827-4c80-b277-a7de72d8c98e.tmp
- Size 1KB
- SHA256 572527d1aeb58d641dbc67ff657de19890d0ac66daa3e4270a1c72de7fc7aa44
- MD5 79616f21aa13d8ac106fbd1e407ecd47
- SHA1 1d9b9b70ce58f03b7b839ba919a4a7f1115bf2ca
- SHA512 8f607e7bbd0cf325d23380cf28aa312234603c7e6367bccf1cc9c0fbd833157a3382f15ef421b1d1a3636175fe055251ee325211053d902e6ca2d6a0f56257fe
- TLSH T17A419DF793F4857E8A1196F4EB156E1FCE6A0524131C3CA689D46E1B43F2872D20078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 1df2670307b8e8a916bd8575ef9cf25771497c387da1e1a15c0d4457a6763b5a
- MD5 af526429270dc61e8989150796f97d42
- SHA1 e63a766cc459a3cbd6f1ec85a798d2fa95bb09a0
- SHA512 ef831aae11ae4468635db54e450bdd5b46d62289e5c998eb3e89a1ff034588a2e052b946f98f974b0d21dca809cd9cf8c212a5cf485f1daadedc63c0d9fd8253
- TLSH T117B01244C8437701C00212F411D418987154DF10A606130285F04E11BC39151955B06C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 4d606efe509c6969267b6acf5341dfc411babfe4d1478f29bd49bd81ce9f5033
- MD5 bfaf987f563ed66e636407dd0bf8e112
- SHA1 7ef33004cdb40b620475cc94092a3ee6fd0be125
- SHA512 28f407f8f87ec1ac797a099289b969f4690ad8b03ada0485bd0092677ede787926147dc36f69d90674a886455b4d75f0b9c4a56a9b2621320757bf221a98ef86
- TLSH T1FFB02200C003A222C08303B028A2C0CC30E0CF22C2030302C2E02E32CC2AEA08820032
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4be51b3-fb12-47f3-bb8f-f4a802004ac5.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d0ced766-1ce5-44d1-9af6-82babbfde589.tmp
- Size 12KB
- SHA256 291ed5496651b14b3507d95664e214fe0b8f826db58e08adbada513eb2fc2892
- MD5 c9080c68f9a829a63a3b1c030f3d5305
- SHA1 db466c9f83efb2225345172978d4536ced494467
- SHA512 5bf59b30827f28f8198135034948c5d4a23b2b67c6381b2a161beeb597bae6d26929a3cac2982342431da5c666d12bfc2fc095b4c7e8a582eff10173acfa0fe5
- SSDEEP 192:VRzSLzzEHE/STIzdsv7MpAPRp2JK9tHsb+WNnqIPPLGDkwzzam4YVyIsnAUge:VRmLcqSC4wUXfvwJPqDTza38e
- TLSH T14142B62EAD20783B5CDAD72AFD657793DBF9102530942E44EAFC892C21DB5CC212742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b1e80c33-24f9-4c31-95a4-b360c74ed1cb.tmp
- Size 132KB
- SHA256 f05ccc2d35572ac781f44a1211cfd7e38334cc3c07368636336a839246d1a01d
- MD5 13c500e55c399dd901ca82e9cb94f487
- SHA1 ab829a748d174bec45f0eccc19e7487616ba60f8
- SHA512 a557a59953cfe25219be73d8cc80abed5a3a1e90f19f14fe34cf42f1f9d7de76abbdbeb93f8bf01294d7af7d1e0263334979e59f558d8cd00096928de2d88feb
- SSDEEP 3072:uT7IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:uTjPtbmf1K49XLWbEPi4NTKlLzh
- TLSH T19FD312217D05BCB8A9EEEA21A1801E16E5B8D94F953D3BE55CDE3F8805A36DDC304C63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c6c71512-a130-4c65-836e-5f5decf71eba.tmp
- Size 131KB
- SHA256 9329caa469c7e0ff408b96f4282a873e33d3db7bba3b0bfe4b3fb57957e1fa26
- MD5 a29e58b082e3c4446159775667f5aeda
- SHA1 335cff5d697f9aafb0523d36d7329e8e6b7995d1
- SHA512 fd7c46409e0e4b31444eb8cf36e1148b78b78a2c6f11a94a9ed3d47f64965ac30770f0c696fe64cfca3dcba555c4178d284f71a0f21f2751c04a04331ff03964
- SSDEEP 3072:JIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:1Ptbmf1K49XLWbEPi4NTKlLzh
- TLSH T1DFD312217D01BCB8E9AEDB22B1901A15E6B8D94FD5397BE61CDE3F4805A36D9C304C63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\de5e528d-f628-47ac-b9ad-f897056bd147.tmp
- Size 132KB
- SHA256 fc3854040da8a04c642d9b7fe2c65ab0d3186854803e083ca3544d230bad3bff
- MD5 eba0869e1039084029df65f52285e7ea
- SHA1 5cdb210043eb862250ee793cb5afb50f1cb597c7
- SHA512 96f92c22c9b01473ad1d0904bb22ed14cb579aaa94d761ea62164d95ac1bbd79509c0ad6ce304d70fd2ec7f0392b6c9344728ef4be555564cb9d1080f1aac693
- SSDEEP 3072:NIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:JPtbmf1K49XLWbEPi4NTKlLzh
- TLSH T1E2D312217D05BCB4A9EEDB21A1901A16EAF8D94F953D3BE55CDE3F4805E3699C304C23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2d792c2-8860-436f-b06b-5fdd0d94a3a5.tmp
- Size 132KB
- SHA256 f79007dc4a40d5fe2b70c3860f7685b01869d594c191ca698ce9549bd6e7b434
- MD5 f87e60c2cb2d597665549670bbf5920d
- SHA1 99fbea66c95a36b112cff2a11d2cd2329b849dd0
- SHA512 01f84ccb4f9c0325dc46eadba646d1b47159e25557ce7b44cd3bb2442b9310cc8b5f46ad538857289e17294e97c7980fdcea38a74d4562688a4189bd3e5dff95
- SSDEEP 3072:yIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:SPtbmf1K49XLWbEPi4NTKlLzh
- TLSH T19AD312217D05BCB4A9EEDB21A1901A16DAF8D94F953D3BE55CDE3F4805E3699C304C23
- MD5 SHA1 SHA512 SSDEEP TLSH