Overview
overview
7Static
static
3Xeno-v1.3.40.exe
windows10-2004-x64
7Xeno-v1.3.40.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 04:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.40.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.40.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20250619-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260506-e5geasev7j
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6012 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225157267892523" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 2124 chrome.exe 2124 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe Token: SeShutdownPrivilege 5072 chrome.exe Token: SeCreatePagefilePrivilege 5072 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe 5072 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5072 wrote to memory of 4684 5072 chrome.exe 78 PID 5072 wrote to memory of 5064 5072 chrome.exe 79 PID 5072 wrote to memory of 5064 5072 chrome.exe 79 PID 5072 wrote to memory of 6012 5072 chrome.exe 80 PID 5072 wrote to memory of 852 5072 chrome.exe 82 PID 5072 wrote to memory of 852 5072 chrome.exe 82 PID 5072 wrote to memory of 588 5072 chrome.exe 84 PID 5072 wrote to memory of 2576 5072 chrome.exe 85 PID 5072 wrote to memory of 588 5072 chrome.exe 84 PID 5072 wrote to memory of 2576 5072 chrome.exe 85 PID 5072 wrote to memory of 2504 5072 chrome.exe 86 PID 5072 wrote to memory of 2504 5072 chrome.exe 86 PID 5072 wrote to memory of 1076 5072 chrome.exe 87 PID 5072 wrote to memory of 3092 5072 chrome.exe 89 PID 5072 wrote to memory of 1648 5072 chrome.exe 90 PID 5072 wrote to memory of 1640 5072 chrome.exe 91 PID 5072 wrote to memory of 2124 5072 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd6703c728,0x7ffd6703c734,0x7ffd6703c7402⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,13642945109208905568,5926070175382517145,262144 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1952 /prefetch:22⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,16050582318339553017,15009842129442263680,524288 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2232 /prefetch:112⤵
- System Time Discovery
PID:6012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,15782526534261513971,3088831066837608496,524288 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2276 /prefetch:132⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,3673787144656601960,12898571676231614962,2097152 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,3410258853001811978,9462973154084997773,2097152 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,4587339184547206484,6320568088323455827,2097152 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4344 /prefetch:92⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,16902628653748983858,16072241976506817737,524288 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5236 /prefetch:142⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,9409046958576413047,11998783003174751646,524288 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5252 /prefetch:142⤵PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,2099246192512899187,711334049679487388,524288 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5536 /prefetch:142⤵PID:1648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,13407029719224798288,7320211928624645805,524288 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5584 /prefetch:142⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5480,i,5627385673863736469,15198224169425834052,262144 --field-trial-handle=1956,i,10337655018251426814,12651990387974825894,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5600 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f3fc164-549c-49ee-97ae-522654b8b08a.tmp
- Size 17KB
- SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
- MD5 00354c26d974dd37c82892cc4543401d
- SHA1 998a31960482acf892a8127374d96c3a440e9e8d
- SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
- SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
- TLSH T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 84ada5f9ea380413094bd14aecfa31047aef3e5d9ccc09b0f15134dae0e77bf4
- MD5 bf584c10c6b74502625a47d9cc47f2c1
- SHA1 67aea022577a9052d903abef0057b6a11568e0c5
- SHA512 369dabc34a9cf7d42566a301d92fbf4f83d53f15f4689034deeb4b5cd9300c30d185d2049ff5b390797e949f46a56e3e7d0f2b78fae245503102a078f0d5bd15
- TLSH T184E0EDAAD834E83B0CFE475960908705EB9013162B90890BBA3E92088FB462A418AC5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 1c59aca52505f81c23d8186dad6d18efc19dc610f6bbb7969b9cd55ac48a1da4
- MD5 45001c5bf16fd17ed19c4cd386a3b781
- SHA1 6dd05d44c0c5b36a1d8db9855c9f84d699059ac1
- SHA512 d0a4ec9305ce230301881b3866ed775592d4459da59d8ed3afffac1826ca66ceb0b7280d98f5e4d0167a634e904e649ea3c69c207432b51c7277cc3ff0b1997f
- TLSH T1A2418EF793B499BE8611D2E4EA156F1FCE690524031C7CA689D4AE1B43F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bec098631526773f9ce3b97e7ae9f836eaf2aa6e54166ab79db36801f15bb8b4
- MD5 34c616bec98e4619fd952bbd45193899
- SHA1 dcfc0b7b3b0ae389c9a5c8c52117c7d5574f3d02
- SHA512 c11c3717fad503580217e0c467ffac8d872b4453a195b9fb27c38f6710cec1e88f5a072904d5e75f0489893d3a98768bd0f10d7955db5ab2617e0bf956b41214
- SSDEEP 192:ERGeQeJSXoNgn/mn/f3xetua41v7pFpAPRp2QJl9YHsb+WNnjePwoakwJh1wCVyz:ER/QeUOZbUXNOw6Ppap9e
- TLSH T12542E72EBA14297B8CDBC219FE21B753E7F6102175941F84E6FC8A2C10D79CC211701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 33094b75ec841e982683f2acead3c855f1b9d39e24015aab3538ae697a0aea77
- MD5 66caa625e49bb82ccd386e3167d58ffc
- SHA1 a7d4641a122319aaf411b3f56c20cdd9678c10b6
- SHA512 0eb8ce6fc5102c47328df24ce8fcf689f39e71d78574b6d6653e9cd08e7e7440274e3762079dcc418c35c6618b9f87d655365ff88cbaa664c681896266a600eb
- TLSH T194B0121080426A41C08303F0158204E872145F118B06130153E06A71D8761A24025160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 592630fc13fb8c67774da1c90f6a43f199e11e3147881a702b61a73d01bf5748
- MD5 2c11d550f99ab46234291eee5d4c4b5b
- SHA1 ed4a28386de4ecc1313103533281b83187251c56
- SHA512 104516f81b2d8ff70ac55b2afb953e57265c69fcae4ed4346c4e48c8a28d33aeb926f0ac2ae15fe495b21547b5eb23aaaba7b7eab3d06edd7a0cc0b3f114f30b
- SSDEEP 1536:iKX2EP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:o6++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T1399312B9981F7C7953AFD69690079CAC4CE39CDE1518247C30C75F1E14BA3A2A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 6666079255db11c0389e45dd6df32af1b451c32df6d241c20a8f34c7ce3f0090
- MD5 ff1f6da8d5f6230b34bfd52de8aa3017
- SHA1 4cea6955ce2e0850371ecd7ccf8dff2b348a1f7e
- SHA512 6d1b3361a5fa7afda0f1daadd0539a0f338f2936f73ee7ca67f2aad34ccfd188290347e604cd71ac3ca6b670dfe7045781a7b747e8002427e841d094c2e80de7
- SSDEEP 1536:iDaP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:x++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T16A9312B9991E7C3963ABD6A690079CAC4CE38CDE1514147C31C75F1E14BE3A2A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 4c6833d95af505cad836c084c079bee5efaceb352077c30d31ecf1c482cff153
- MD5 e67b838f67d1da802f5a1630dbed6c9e
- SHA1 4e20111f54aba444da5c2090c442b8f1318dcb22
- SHA512 eec07f8cff13c9e2e5453a78a404375160c02fe75f7aae6f142341eba167050cb6d99e716186b3d5e0f3756fcb19ae090d858054809a2cc69a6e7f295696bead
- SSDEEP 1536:STP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:o++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T1899312B99D1FBC79636EC69690079CAC4CE39CDD151414BC30C75F1E18BA3A2A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 f661ac23c167fd38a8f5fbe55f7445b28f067e4cf02165af645125832ceb5543
- MD5 de3dedbf50e1fccf02a0229553de2c30
- SHA1 63c36a69f69f2363b2b7caa7102b68b707edfdfc
- SHA512 1263ca5268afbfa16b9eabbc1f49b9d5a39800f279b2aa3c77ccb312da3a353bd83b436f3b722d01e37b00dd33906968d35e37d503ae6afa3f3447bb2fe92a14
- SSDEEP 1536:3DaP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:E++J3qUQm08KMWF0bFTcVHr6zo
- TLSH T1849312B99D1E7C3963ABC6A690079CAD4CE38CDE1514147C31C75F1E14BE3A2A34B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH