Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
300s - max time network
309s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/06/2026, 17:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
300 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260606-wdevtsbv7j
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1872 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252420885567680" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 2432 chrome.exe 2432 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1040 wrote to memory of 3388 1040 chrome.exe 81 PID 1040 wrote to memory of 2752 1040 chrome.exe 82 PID 1040 wrote to memory of 2752 1040 chrome.exe 82 PID 1040 wrote to memory of 1872 1040 chrome.exe 83 PID 1040 wrote to memory of 3512 1040 chrome.exe 86 PID 1040 wrote to memory of 3512 1040 chrome.exe 86 PID 1040 wrote to memory of 1956 1040 chrome.exe 88 PID 1040 wrote to memory of 4984 1040 chrome.exe 87 PID 1040 wrote to memory of 1956 1040 chrome.exe 88 PID 1040 wrote to memory of 4984 1040 chrome.exe 87 PID 1040 wrote to memory of 1628 1040 chrome.exe 89 PID 1040 wrote to memory of 1628 1040 chrome.exe 89 PID 1040 wrote to memory of 4428 1040 chrome.exe 90 PID 1040 wrote to memory of 2608 1040 chrome.exe 98 PID 1040 wrote to memory of 1852 1040 chrome.exe 99 PID 1040 wrote to memory of 3028 1040 chrome.exe 100 PID 1040 wrote to memory of 2432 1040 chrome.exe 109 PID 1040 wrote to memory of 2192 1040 chrome.exe 110 PID 1040 wrote to memory of 2192 1040 chrome.exe 110
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9edcac728,0x7ff9edcac734,0x7ff9edcac7402⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,16859907609887534337,12491636911704992885,262144 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1872 /prefetch:22⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,638539487819518703,13036510374062385328,524288 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:112⤵
- System Time Discovery
PID:1872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,14809864883932682946,3405804135581105965,524288 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:132⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,15229955620299913825,2642185034877249274,2097152 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,13858355250216140781,6626480528326557284,2097152 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,2097331313873298467,15921163871444012362,2097152 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4008 /prefetch:92⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,11354997471677996107,6374245094640686526,524288 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:142⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,2283218312003544036,12284952069145180481,524288 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:142⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,7919198256971850255,12254700973431817210,524288 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:142⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,373866642532267380,8033668292937784204,524288 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:142⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5564,i,17206010066148394952,598380449543992728,262144 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5140 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,13706606343343799081,10494859467275727835,524288 --field-trial-handle=1876,i,15846263642471918550,14342933036032181799,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:142⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 398e70c06263838b87bd27416afcb451e5ada5b3bf53a93d87b12e3bb2d7d0e4
- MD5 e3fb5b029fb177d12754c4db19e5c520
- SHA1 dee94aa2c1e6f30fcd66aaf127c5f2289d67f99f
- SHA512 d121e3dcb5da02fc9a82979bc199a3e16546964e0233aa2e474b5c24573ce0d1b9fce4d3bbdd9ac4b71c993cdf3b185b35ea3c9134176b90d9de9e9a535d2a8c
- TLSH T15BF0F4A6C821AC3708FD0B2D70944B8AF750136B2780894F3B3C560C8FB063B869592C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 ce972f91a4b4348c7c1bb2c9851b83c4c6f847d17df8c5c4ca16144656dfc8e3
- MD5 302c0e3d0423aeb7ce33a9789f28ecf6
- SHA1 68bbc1ae1976a33208c6b3add7f2403283659537
- SHA512 04c6a17721b1c05eb1f18a4fa021b20b9910730fe3e4e2c016d4fb0c892d8f95095bd278a3b08e6c072cfa3a176d90c884a652a11e8745cbc6e3e1dcc5c091c9
- TLSH T196518CB7C3E8867D894156F8AB256F1FCE690E18536C3C66C8D4AF4F53E2971D20058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 fce1b93d6c8a97cbc2ead5ed9609e09132231b81a7c95adab03f493047482ce1
- MD5 a101f4602e41ad717bca437c42dae75a
- SHA1 3f89751570366dc9dcb6e1b30f1208a5d7d509b6
- SHA512 67738583d7af49b8743a9d2e8d1f61198cbba32c5a6e124ccd030b192601b8cde135d98fa48ccfb54c2a87fd1ee52437a62a6fad3e221465433a19478564da36
- TLSH T1D4518AF7C3E8867D890156F8AB256F1FCE690E18536C3C6688D4AF0F93E2971D20058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 25249091f3fea21ad041d6d9c77670268448fdfab82be3a2fcf2bb156ae8f5b7
- MD5 fb45a1ee2e855c10922fee6439ea002f
- SHA1 6d00fedb08b63d333a7f35061b38193c6612e576
- SHA512 06acee7e1a4ca77f0622de6990dcbdeac0fa5bfe89fbd8807378b83c62ad3ce22dd498e0e47cc5c048173a63d59a783d4be8d54e612aa1ea8334d15d97235384
- SSDEEP 192:RR1hvBYRB0t1Bv7H+pAPRp2rnr9WHsb+WNnAIPDZ25ekW30VyIsnAUge:RR1Z51RiUXoUwjPF2Mwe
- TLSH T12442B63EAE50657B9CCBC32AFA657797E7F5106161D02E84E6FC8A2C01D75CC221742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 2aa918cae88a3d3380143ee1e9fcf5ac90b0a691ffe6ce98d2b529d479c6cfeb
- MD5 ee7b95e671f9403c565d27ad29f520aa
- SHA1 30459128f47e6a10f86bb9766de3f0c31c629b13
- SHA512 8d8d7aedc121bc90c7140a46696252ad61941d4544f288ae9b66c79bc7a04577bf343b3f15c83b4b488672a00c036cc0d6ef6ca6a8186a6a1a5ae934a0722867
- SSDEEP 192:RR1hvGYRB0t1Bv7H+pGPRpcrnr9WHsb+WNnAIPiZ25ekWU0VyIsnAUgE:RR1Z+1RimXeUwjP221wE
- TLSH T19342C72EAD10697B9CCBC329FA657B97E7F5106161D02E84E6FCCA2C05E75CC221742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
- MD5 a6b03dd39d632b77a2b691136935ce1e
- SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
- SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
- SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
- TLSH T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 5604db6e6110f356d07a0e200a049cb1246cc37971382116c78e3e4d4e6a0f72
- MD5 19fb4b70019358bbc4c7017073fb179f
- SHA1 7242d6df7c4e0722535cfeb88d9aabdd691ceee4
- SHA512 3d8badfaf24184674543d508cc51bdb83a23f537a4ce699c0c4219016769a5498aade9887d0258b963ab06159279ad88e86ca22969f7f70e97fc248f60ae9fef
- TLSH T10FB0125080056602C41606FC12C25488B1189F109B0F570253F47A2B982A2A08014050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a5b1.TMP
- Size 96B
- SHA256 9528ce6b5365f88312f498a7b3e67aff8067c82bd268e129005ba535264fa6c9
- MD5 1eb464aa94f478387bab3d617aac581f
- SHA1 d81d667b4df7d60eff68fe287aae4021db4b286c
- SHA512 600d4116c39044d99d261702a6b7e934f1841c966f6c42447881a5a927418cad53b9062a4c1622aac5cb99981d46f1a80dae36c4e38684cde0f60516aea818cc
- TLSH T1D7B02222C0C2A302C00303B02CC080C830E0CF20C2032223C2EA3BB2EC222200020220
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 149KB
- SHA256 a8277521b7a5ad980f6e2a37841368beb8b27baa1409911f6a4c6aa2bc849dd8
- MD5 2d74d79f5249df63149ad97d524e4fc4
- SHA1 083643fe40c45da26681ad1f14e7ad574e79ed7c
- SHA512 3004feaf55b6d338dc12b7484b903458fc4163a629ba7755ff632e123864ddfa3ce05689018e5a3ea9d453d8126c102cb1195e5a084d765f1c5f3ae0e3836dbb
- SSDEEP 3072:ogYU2pFsUJEzyCzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:JYU2pnEzjWDfxA3OnjrYQ9EU0/hEV
- TLSH T1A6E312A15C3AFC660DBCF958644D3E64BFF86D5612C26CC5A6DC2F4D24EB2CC0826A74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 95322520bc8596d9719070e75be250d9e44b1e4e56eed4465ca376422eb062f4
- MD5 e1902b8ce8ec562530875bbb2a7e3ef1
- SHA1 e1cb4cc137a8ee2ef1eb6653d1fae1fd62aa661a
- SHA512 5839944be7fb974471e4ad97949aa5d22eee05c4af489412914b649897d1d3946ccc8e376e32fd3fb79e6351f208db310177b0e79dd16a7ea51a49fcf07510ae
- SSDEEP 3072:F1zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:fWDfxA3OnjrYQ9EU0/hEV
- TLSH T18BC302A11C39BD660DF8EE98B40D3A60BFF4AD9A92875DD352ED2F4C14FA5C81139930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 9c1a36d1bc0098086346fea833cb748a01e9da9f2f326776b9125ea2db2b9061
- MD5 89845dec00072ccf8f558b783a8fbca5
- SHA1 bb6876f8e3e77915293ee6429b55572fc8cea3b9
- SHA512 2589bff5f75ae35c9c2a1925ae8ae609cdcc10fcb8df04a195a3f2ecfcc2621a0dc8a75947637c1b60ae505e3ed05b9d6f1c6b8ca4712d38cb539ed6e99bf75e
- SSDEEP 3072:81zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:KWDfxA3OnjrYQ9EU0/hEV
- TLSH T1A4C302A11C39BD660DF8EE98B40D3A60BFF4AD9A92875DD352ED2F4C14FA5C81139930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 55b88b6d378cde421538719841686b3e6c3cad853ecf845fb2693316b1930e8c
- MD5 76616a3aa2bf80c4dacc9b62129a0872
- SHA1 b06b30d4d306d023a367184a362d37468efea648
- SHA512 76c814e2b7cecb0a6fc1b694b5c990bd4f818957c5c8c6174d388b0fa9b3d63a401dae0de0236acfc7e44fe84929110a820df48131069f06b4a836773ac935cd
- SSDEEP 3072:BzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:lWDfxA3OnjrYQ9EU0/hEV
- TLSH T158C302A11C3ABD660DF8EE99B40D3A60BFF4AD9A91835DC361ED2F0C14FA5C81139970
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 4e127c796823ecb74bfb33d835159822c88175c5cb75c83a7e4dbe98bb43f998
- MD5 3bd65c569793b6590c2c01953efb0f05
- SHA1 205e19d343f4244a495c3d79a6441a9d620dc746
- SHA512 e8681a4ee86bcb3729a92dc2b82b43bbe4002a90cf4b1b4b09fcaf979229ee32667fb587e6b81411676867083e76ed0d6a3be31478add91e853337f55f298423
- SSDEEP 3072:YyczWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:YrWDfxA3OnjrYQ9EU0/hEV
- TLSH T128C302A15C3ABD660DF8EE98640D3E60BFE46C9A91876DD2A2EC2F4C14FA5C81175930
- MD5 SHA1 SHA512 SSDEEP TLSH