Overview
overview
8Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-21h2-x64
8$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
6resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
900s - max time network
880s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/06/2026, 00:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
900 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
26 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
16 signatures
900 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260606-ae2v4agy3p
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4732 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251784075634595" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 2164 chrome.exe 2164 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe Token: SeShutdownPrivilege 4444 chrome.exe Token: SeCreatePagefilePrivilege 4444 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe 4444 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4444 wrote to memory of 1992 4444 chrome.exe 87 PID 4444 wrote to memory of 4296 4444 chrome.exe 88 PID 4444 wrote to memory of 4296 4444 chrome.exe 88 PID 4444 wrote to memory of 4732 4444 chrome.exe 89 PID 4444 wrote to memory of 1256 4444 chrome.exe 90 PID 4444 wrote to memory of 1256 4444 chrome.exe 90 PID 4444 wrote to memory of 4512 4444 chrome.exe 92 PID 4444 wrote to memory of 2548 4444 chrome.exe 93 PID 4444 wrote to memory of 4512 4444 chrome.exe 92 PID 4444 wrote to memory of 2548 4444 chrome.exe 93 PID 4444 wrote to memory of 1548 4444 chrome.exe 95 PID 4444 wrote to memory of 4756 4444 chrome.exe 111 PID 4444 wrote to memory of 2704 4444 chrome.exe 112 PID 4444 wrote to memory of 960 4444 chrome.exe 113 PID 4444 wrote to memory of 2164 4444 chrome.exe 119 PID 4444 wrote to memory of 3852 4444 chrome.exe 123 PID 4444 wrote to memory of 3852 4444 chrome.exe 123
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9643fc728,0x7ff9643fc734,0x7ff9643fc7402⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,7963940650260539558,1567147004776933612,262144 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:22⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,17629257059653953334,8111123450631703208,524288 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:32⤵
- System Time Discovery
PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,17532291788857616817,8761847702085005534,524288 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2480 /prefetch:82⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,2448756919869951847,10750350587658588942,2097152 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,14483313151073273193,8567321998386848002,2097152 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5148,i,7652181989480242520,12056237894128773614,524288 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,2625810845214966351,10264896943726240191,524288 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,16046345716590024704,6006431904286453806,524288 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,14914330839294271451,16805584275921946690,524288 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:82⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=984,i,1735399964909338184,13842352633750398518,262144 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,15851288290762179333,1485067378062117498,524288 --field-trial-handle=1980,i,17604308953130634861,9841320552518875767,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4612
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 51a115075de39b0d0147c6ed2f254c9ac954fb5fe09d010ba93268734143d9be
- MD5 da06d6d12e3ea29ddf3ea71dd7c998b7
- SHA1 3df14fc130666070273cfb6444100a457ecb7a00
- SHA512 1b4b934bd8235e45999b22722e9d441e0c24c799ae6c6975e8c9a02bd4f780fd59bc702e9f4221929884cf3f1015aae695ac0d50911315a903ee255b50c42353
- TLSH T13DF02DBACD21EC3B18FD171C70A5874AF755136B2780494F7A3C520C8FB1A3B565585C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d2aea505c537b0c78ced47ff6f8e5f3102a32897398de7775a995c468b202d56
- MD5 53d0638d2d061adb4d5e618b49d35e40
- SHA1 6a46af659e28e791c90e0f7f6b1a1f20a36f8947
- SHA512 adc29974f5d0223c7ff9890e2b9ee34392496963b434798b016a67c8f42d59137eab9c6f0433ac25ea5547eb31f05fdd33f87eade02a54e9f23265ab67e13634
- TLSH T1834168B7C7D8857D890156F4BB156E1FCE290E18432C3C5A88D4EF1B93E29B2D24068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d4ca361d1f4ebb2db806d1c1cfba9433edc359d07147d3ca8e5cdb7813a77c30
- MD5 0ae2201e7ea97a2f6f8132107be921d7
- SHA1 8cf5612aefdd18f0e4cdf714266cb5a16ff6d61a
- SHA512 f2030d519d3ffc60872ba6b70a62ea5068e7c6db48faf2f4af6e35430485fcae609eaffce8a80c0b655092dddebb9f4241019284b9b3d2caec6c0839889a5071
- TLSH T1924169B7C7D8857D890556F5BB256E1FCE2A0A14432C3C5AC8D4EF1B93E29B2D24068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 5eb1f23fbb65805ba7bfdf472e23ddfad20e25e59cd593a28d322a008d549cf7
- MD5 9dc8adef9ecf3a90a0fe9a9746ca92d5
- SHA1 8d3c1508cccba8944371c9a458791eb1d3c03e18
- SHA512 b8cd117e201feb469d27c75f86d3d756a6f8e71422d2d31d648e1dd04a0f78cda1b37e5f99a39e2a0ef8f676f38dbda8f7734db4b983176f1842045562a30795
- TLSH T18FE0266B876971A751FC08BB2D08BC0EA5BAA83102421CE4CAAA826DE0808F71F05597
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 b6958e97e2f9acba8da70cd20b873a5c6f8a32d666b771674fa206fed253f78d
- MD5 212532026b160c669dc6c958cf6ff157
- SHA1 c0940250e52e34a85590814c267e10f3dd23fa7c
- SHA512 044d340562d1f47dbe537e37ae6e115d584651cc6b1509b9512ebe1b5755add4c7ccd4b1245f9d9c5c7b8cd3262c20f150805886b9f32d531eaf0a5d0d97df0b
- SSDEEP 192:6RNkHvWev72vAPRp2Zp9THsb+WNnSbPIst2JTfYkw+nVyIsnAUge:6RNkeaC6XgFwqPH2uWe
- TLSH T11A32B62FA920657B5DDBD229FA617767E7F5103135D42E88EAFC8A2C14E75CC222700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 58adc7947ee8421d5717bea9ccd5f40c690c154caaed0c8de27606a8d4d1bdfe
- MD5 e46badf214b6677ddcdb0b9fc58bb200
- SHA1 8e0d6cdfc07fef98639ca1229f7706bfe1e333fe
- SHA512 a32b6f82dc1a5a227c5aa4e599a6fff033824ed5a0b690f55b37eef62c3f6fe2195d1cdd8f520dc9cb50473cc8568a9d3a2b0fd3f110f8fade52bacd0b6c60c9
- SSDEEP 192:6RNkHvWev72vxPRpdZp9THsb+WNnSbPRst2JTfYkw+AVyIsnAUgE:6RNkeaCxXhFwqP02uVE
- TLSH T1F642C72FA920247B5DDBD629F9617B67E7F5103135902E88EAFC8A2C15E75CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
- MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
- SHA1 c0965f169b36b690aaf700b8f80359944a908774
- SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
- SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
- TLSH T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4d80d3f9a2fb64321755f59aff907ee92983c68cd5ff6c139e27acf3ea70b7b7
- MD5 1e80e9542f63bbbba2b1f3adb7972808
- SHA1 38fb26da8996eca628f0dad77b03d7e408ad5ff8
- SHA512 e072a112177037d643a6a54b7e75f6059915d92b701cd45c4aa4a446645d2567d0b77af86246d1e92373a471fab1b538e33e9534dbc466846a30457cadf3e62a
- SSDEEP 3072:z2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:zBm7Rkm1tYpBeh2BAom
- TLSH T154C3123B5D74A8765DB9B71EB08E0B1F1EF14AA6C930DA51C8D46B0433EA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 40d127e4ff8feb86bed112349b8c5f7291e80f455f42bf8516a124446f06fdb3
- MD5 a28579ba3a8fc96f46ca52d8b18752ab
- SHA1 7926e1b38529dc82c38a9641c9d884ffd71acf84
- SHA512 b38f1a7ca3be8b2062338985aa8ce00ff529e04f801a35b3786943647b265c86c6e893c25229262a2b804cfd6c260dbb31db5b2e33a0edf5c2dcf4cb692b119d
- SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:3m7Rkm1tYpBeh2BAom
- TLSH T174C3023B5D74A87759B9BB0EB04E0B1F1EF14AA6D930DA46C8D86E0433FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 9ac583a82c4dcfe74775be73e37f4260afdb89519de6bcb3cf89e16d9861e9c0
- MD5 f356148c93cda91d4053c4c3179997b9
- SHA1 b3d3cc25755ecdcf377c8ede38bdd5871e6dc433
- SHA512 99b75943d59407756da266b97cc821692251d27d75655ccb2c80ac6186f5e10de161126a2ee72150b7b7f0bbfe385c072f360b591731dc0aec5213e5e1a2bd5f
- SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:1m7Rkm1tYpBeh2BAom
- TLSH T114C3123B5E70E9775979B74EB08E0B1F1EF14AA2D930DA42C8D86A0437FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 38872f79e09c6c4807e0e60eceff179d2593069cf122ca5848ec5aa752b18305
- MD5 8eadfaaa6b4683596a219edab958444d
- SHA1 584976819fc0b23b18dc1f04d3e4f4ac81f9ed45
- SHA512 5aeafe2ee5035840066598acbfc26a4feddc5c31c29970e4945845166577377481fdec8ddc1cce127968fddcd33c1422ff4e8551cd446e54939b69c0cf1708fb
- SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:bm7Rkm1tYpBeh2BAom
- TLSH T16AC3023B5D74A87759B9BB0EB04E0B1F1EF14AA6D920DE46C8D86E0433FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 9726995d94a7bb66c08aac2b38203eaa6162b620a5659ea30880014a4c0f72da
- MD5 6e1f27a1e2ab4341d52b65b9b088c426
- SHA1 25862ff5ff731bfcd58eeb3a03f346924ef12c09
- SHA512 4744dfa971b00130e477a869e9032c0631d6ccc3662546f6cfeec2c2dd4582cb082684e382cc2c1643a7d34070fc0cd44b1515326847303c766f566c60294031
- SSDEEP 3072:u2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:uBm7Rkm1tYpBeh2BAom
- TLSH T157C3123B5D74A8765DB9BB1EB08E0B1F1EF14AA6C930DE51C8D86B0433EA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH