Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
299s - max time network
306s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/06/2026, 17:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
300 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260606-wdevtsbv7j
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2708 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252421008159054" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 3596 chrome.exe 3596 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 568 chrome.exe 568 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe Token: SeShutdownPrivilege 568 chrome.exe Token: SeCreatePagefilePrivilege 568 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe 568 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 568 wrote to memory of 1876 568 chrome.exe 88 PID 568 wrote to memory of 2708 568 chrome.exe 89 PID 568 wrote to memory of 2716 568 chrome.exe 90 PID 568 wrote to memory of 2716 568 chrome.exe 90 PID 568 wrote to memory of 4680 568 chrome.exe 92 PID 568 wrote to memory of 4680 568 chrome.exe 92 PID 568 wrote to memory of 4908 568 chrome.exe 93 PID 568 wrote to memory of 4908 568 chrome.exe 93 PID 568 wrote to memory of 2824 568 chrome.exe 94 PID 568 wrote to memory of 2824 568 chrome.exe 94 PID 568 wrote to memory of 4320 568 chrome.exe 103 PID 568 wrote to memory of 3308 568 chrome.exe 109 PID 568 wrote to memory of 4724 568 chrome.exe 110 PID 568 wrote to memory of 2264 568 chrome.exe 111 PID 568 wrote to memory of 3596 568 chrome.exe 117 PID 568 wrote to memory of 4500 568 chrome.exe 118 PID 568 wrote to memory of 4500 568 chrome.exe 118
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ff81479c728,0x7ff81479c734,0x7ff81479c7402⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,9588535299064090930,16689665330779647985,524288 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:32⤵
- System Time Discovery
PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,13574679262358776019,17906882326300044541,262144 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,17250942477891675662,16854458311691372345,524288 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1788 /prefetch:82⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13778904834619112527,8364334536377580380,2097152 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10670541735422431952,9454963415294404285,2097152 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,2963304611680760504,500149945337701895,524288 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5420 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,783077447804604438,6997249617831550214,524288 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:82⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,2029950850477874545,8157447851821513265,524288 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,11277312956002120036,11414853993597255312,524288 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:82⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5628,i,3465276060377030168,8278266621783612399,262144 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,12839784823309105288,8370504704155432187,524288 --field-trial-handle=1944,i,18100922886691112657,12390327265889648555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:82⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2260
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56eba58d-0188-49ae-8c74-2fb2a4cb2273.tmp
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 f476b673a027595d1140b8629e73d5d98727623306faa04f0f6ae19065019183
- MD5 c236e6855e35fb99960b8521fabe5c98
- SHA1 e38aa222f3c70dd6dee040a5112188b4dacc4621
- SHA512 8715d8ec60aaa3624605c47c8164f2cf17ef2d380246953aba8805286c0b75d8ad0dfa575d61b405f6e7bc3818322e0ce4b46ac5f0f5402f4c1ecd787817e425
- TLSH T160F0F4BAD925AC7B18FC4B2820941B8AEB5013672B81999F3A3C820D8FB5A3B454581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 8b2b6f4529ab15438c491fc3c0ba1144bcc8dbdc1650c86fb2e1d1270c974b6f
- MD5 7d35c7cbdc9b903873654ab8fd75bb8b
- SHA1 54f5a90c20829fd7636d2d8f8375580139b45231
- SHA512 d0b5bb0e9ebc49bcc5cffa31bf0c4759acb1a29d68635588698c6c75149b98795938b4393e8d1977b33cfa9db1140f66d5752669b67710e57784bc9820a0c869
- TLSH T13C418BB7C3D8897D891152E8A7116F2FCD2D0E14032C3C1A88D4BF0F93E6876D20069E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 1c9b4070e236b1c6478ab560af76da73079497cd823fddaef4c85de03ea15868
- MD5 9de46d8f3e1277aa4acba9bf27651a3e
- SHA1 2dd40c206a926b683e7f4a5b09cfdf37525f08e4
- SHA512 527fc7bd3912da0b60696f89fc5f8f842c34952d2b7424a51f177b1c1b058d17949eddeb96e8beeb4a39626e67128c659794eb25fe498ddc74cb9e9b294c7f75
- SSDEEP 192:/R1exIlv78pAPRp26w9DHsb+WNnuuPFK2HeYZVyIsnAUge:/R1eGV4UXo5w7Pk2Te
- TLSH T16A32D72EA910693B5CDBD21AFE657793D7F6102271D02E84EAFC9A2C05DB5CC322711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5cd8172c00bff676f7bad96afca0924258f726b0f57fb4e078a171ae7a143907
- MD5 b6a34ecf08d381597ce125cb952c46a5
- SHA1 dea61df607625e70f7253f5318cfa039b8c08429
- SHA512 65501d8212ae8f45d7bddee4293dd213c1be7d6bac1cc9ac2366e8fb56c77a504bef9f157dd199998083416a55e6a3af8d2f4e43915edf02286624ed19ac06fd
- SSDEEP 192:/R1exIlv78pCPRpo6w9DHsb+WNnuuPUK2HeYiVyIsnAUgE:/R1eGV4uXW5w7Pv2OE
- TLSH T1E842E72EB910693B6CDBD21AF9657B97D3F6102271D02E84EAFC9A2C05DB5CC321711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 ad07d6b9a8702a5781ecd631f66b414a7ee23666e8ae67d54c3893c2ec49a976
- MD5 4cef37e224738cb019c23088321d1f86
- SHA1 93bcbbd66f2e4478c175a3f97b484c0b5f79221e
- SHA512 a0f68351424e9fb355b34faf0ab2b08dd8963dd32ed07018c940b9e9cb04d8d9a5e32cffa41a29cd48657cc75c8d2a3fe891112cd60b950e90332f6af13834ed
- SSDEEP 3072:a5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:a4m7Rkm1tYpBeh2BAoO
- TLSH T146C3123B9D65E9375DB9BB1AB04E0B1F1DF14EA6C920DE52C8D46B0423E97CC1A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 147KB
- SHA256 2f92fef8b9db3724b073dcb873f90eeb466364438a8c603ffad34a87d4323e2f
- MD5 515af8dac6feb9fa15bfeb7c01c749b8
- SHA1 f4600940e1e5dc367136c89ac7138341eb6455cf
- SHA512 c2d0578b22978452a5156a260bdc53240aa92c6c2745c1166b814922cf1932cc87ff30cde6ffc5d257b74f22a629e65d41a352e22e46780e24328f94fae174fd
- SSDEEP 3072:DDCOvkSGCny/8hRGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:DDCOviCn22Am7Rkm1tYpBeh2BAoO
- TLSH T1A8E3123B9D64E9729CB5675AB44F0F0F1DB14EAACD24EA0288D56F0437EDA491E48C38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 aaa9cb1ee247248624bd389b280c80121a7420aa485ee977600a1d7a62ebb57d
- MD5 7bdbefda71e0609fbae010b526c054e1
- SHA1 4dd2b2bff179c5d69ce018bbfed333c95c0af550
- SHA512 9cbde5f95efc34261b2b85e38a285cb5021bddea25f166e3fe598048246f0ec85f41f3210d534569714cbb467ec3888092a9f646f5a44c0031fb763c122aabcb
- SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Dm7Rkm1tYpBeh2BAoO
- TLSH T165C3123B5D65E9375978A70EB48E0B1E1EF24EA6C930DE42C8D46B0477FA7CC1905A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b1c416d68f19d2393910012e5741ad12296a3e19a44b746b48908c4c8035634d
- MD5 26497892dfc1951d2ce1cf88e01cec6c
- SHA1 c25ca245bff4d6c404fef73a6f114764e8f67c19
- SHA512 a67775c0383fcdde1cd942ee1a01fdbd3bbac5ff82a723c66b90899c82a6a3b07fdbfd0908b145cac3f4818ffef219f7b4f6a8675cbec393f19afbafb2454dd7
- SSDEEP 3072:u9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:uUm7Rkm1tYpBeh2BAoO
- TLSH T1DCC3023B9D65E8375DB9BB1AB04E0B1F1DF24AA7C920DE46C8D46B0433F96CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 c33bf1dc2dfeebfc45f4c7c0e91693bdc6b6bbc2744cac8460aa2e5aa2ad6cf3
- MD5 adb30436629570fc18185782d75bac25
- SHA1 f0b6703152343c27d5119d3e28c0c4389a757b7a
- SHA512 20626a2230fd342c8f6d685d76316acb3be5ca21c078e07af7b517b4ce68b4f30a9c0723c4f4d94a2c74cb03646af1e3311929ba3b038ee0d178e50b633d2274
- SSDEEP 3072:z5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:z4m7Rkm1tYpBeh2BAoO
- TLSH T118C3123B5D65E9375DB9BB1AB04E0B1F1DF14EA6C920DE52C8D46B0423E97CC1A44934
- MD5 SHA1 SHA512 SSDEEP TLSH