Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
300s - max time network
305s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/06/2026, 17:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
300 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260606-wdevtsbv7j
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2640 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252420969201390" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 4100 chrome.exe 4100 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3844 wrote to memory of 4596 3844 chrome.exe 87 PID 3844 wrote to memory of 2036 3844 chrome.exe 88 PID 3844 wrote to memory of 2036 3844 chrome.exe 88 PID 3844 wrote to memory of 2640 3844 chrome.exe 89 PID 3844 wrote to memory of 1448 3844 chrome.exe 90 PID 3844 wrote to memory of 1448 3844 chrome.exe 90 PID 3844 wrote to memory of 4612 3844 chrome.exe 92 PID 3844 wrote to memory of 4612 3844 chrome.exe 92 PID 3844 wrote to memory of 3808 3844 chrome.exe 93 PID 3844 wrote to memory of 3808 3844 chrome.exe 93 PID 3844 wrote to memory of 4660 3844 chrome.exe 94 PID 3844 wrote to memory of 4660 3844 chrome.exe 94 PID 3844 wrote to memory of 4240 3844 chrome.exe 101 PID 3844 wrote to memory of 888 3844 chrome.exe 107 PID 3844 wrote to memory of 1284 3844 chrome.exe 108 PID 3844 wrote to memory of 552 3844 chrome.exe 109 PID 3844 wrote to memory of 4100 3844 chrome.exe 115 PID 3844 wrote to memory of 1464 3844 chrome.exe 123 PID 3844 wrote to memory of 1464 3844 chrome.exe 123
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffe817c728,0x7fffe817c734,0x7fffe817c7402⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,99699804758121038,3872049009084609467,262144 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:22⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,17204618601730619520,17404169365903803376,524288 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:32⤵
- System Time Discovery
PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,17257023902228776315,6463440037179849076,524288 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:82⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,12790874733810943610,6454983019809560914,2097152 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,11132612122825258293,14995363130529656676,2097152 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4084,i,9730424815380818340,3667030318343664179,2097152 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4100 /prefetch:22⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,5243425347017984223,126541600140262525,524288 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,9178746677331716845,7075642420168024151,524288 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:82⤵PID:888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,2757942684534642941,2066931845233360754,524288 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:82⤵PID:1284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,11820481386041315584,6872760191226236290,524288 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4092,i,14563638414139199424,15417134044469634322,262144 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5248 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,3427351219011663134,5162839153663532441,524288 --field-trial-handle=2000,i,14174431272641518882,999293199569974781,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4044 /prefetch:82⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 300eb3525765fef89238c16f1cf69c6109c96aaeb77c835839571d8f42c23def
- MD5 ba14ecdb0db690cf11ec4de9c5be1a97
- SHA1 cafae9d114dcce314f5f6e887918b6b803c86bf8
- SHA512 93b8c696076c7cdf281b2eaf5979328ca993558d0ce06376a61cd3d20053f3f7c93b04cb73ded5b82f09c6c4441210ab508b529e1c00fa05d1c8fcab17557c03
- TLSH T1B1F02DB6C9219C7728FD4B2960954B0AFB5213672BC0596F3B3C930C4F71A3B4586C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 a2910512fe2e28a345ccecf726b9fd45af7b093f1ef4b31555cf888f9245d3b2
- MD5 f99d62f4182bc0b79da2dcfd3bce724d
- SHA1 98528a2b1cfe80174932758608842f212b7c5781
- SHA512 270c09464661c039466920565f7244aa5ae25b10eaf70cd176b77b7a9c0b531eeaa8e53dc445c4944126db937d25515d8eaab8513333332b85882e73eaabde0f
- TLSH T1B3516BF7C3E8867D894156F8AB256E1FCD6A0E18532C3C56C8D8AF4F53E2871D24168E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a11818df92f9ebcc77c95f2fed083ddf21722e16b33a74a493f736afe359f06d
- MD5 523c4e7b5733cbd9d6844c5f68ba15a3
- SHA1 7ed731e08d7b1f8bab64698d87b4cd4005b48669
- SHA512 64ee6ff2ef762ca3fc3e81b30ad79d4e3fbc3af6d0e7e176c972702f1fb5156f2daa50f9d13401bda628c51139b9f226345416377ba42c0660763242d72db539
- SSDEEP 192:LRga0/JLBJdL1LPk7/1v7hpAPRp2ED95Hsb+WNnZ1PvQT2dQkwIkVyIsnAUge:LRga0/RVtk7/F9UXVrwvPvy22oge
- TLSH T16542C72EBD10747B5CCBD22AF9223747D7F6146125A01E88EBFC8A6C15EB5CC221342B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c3de9b63ef522fc55d464a56f144efccf1c176270e5b69891c5de2d0ed41f141
- MD5 66070fbc45aac546184eb35f5e869764
- SHA1 c2e670bd82c6a1bc8c3f6868b4d2c8b46146de37
- SHA512 855e7f4438b4aacebda2d0f5eb773f143c4c9171c3bf6bad4e312d11583205d4a70885cbd4fe8b31e24cfca99736382034e9adc13f2fc61896606ddccaaab051
- SSDEEP 192:LRga0/JLmJdL1LPk7/1v7hpAPRp2ED95Hsb+WNnZ1PqeQT2dQkwzkVyIsnAUgE:LRga0/Rutk7/F9UXVrwvPHy22TgE
- TLSH T1DD42D72EB910757B5CCBD22AF9223747E7F6146125E01E88EBFC8A6C15EB5CC2217427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
- MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
- SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
- SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
- SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
- TLSH T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 2ccdf20982851a7d0b0ffcf612fb5999be2f144be621f36b0b1088d023868145
- MD5 552017741978ab1565a991cfead74bb8
- SHA1 0cd81c672599e56b320e72a2a3f92a76355e7ccf
- SHA512 c869a3f6ee1f36aac5e2878ed444215aee1b4166c3acbd5dcc8d73461f2d88a58b3643e06f6b3b3530d48b1cc9b14944b372f47fa7d5c1a8886222decb626f12
- TLSH T156B0121580019542C85207B41582948C71545F109B0B270147E07966C8251618414060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b0bd.TMP
- Size 96B
- SHA256 1bcf69570159f2cb7351bade385c7b01bbf3f3173b1199fc533048dc065b320b
- MD5 a3e6584a9195c753601aed871547a8bd
- SHA1 6b38cba42929bf15564cc9777ad3f9efa7889ec3
- SHA512 814e722199bb88d960a67ecfbad3b4bf19785e9151f35b32ce429e844b832e26bda5b5e7541faf520eae719d0d8f3113e04be4872c134870c28baf9042b2e960
- TLSH T100B00265C20AA313C08203B439E5DBD8B160DFB7C6035366D2E42E67EC2577195651B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 152KB
- SHA256 719d7728f53c77bfe716f208a3c66c33c48393867f942e81fbb476969df1bae2
- MD5 e65c2bd939c0da2892ed706800b9c272
- SHA1 62dc83618d9d3df0203efa8f292dd1fa998ba708
- SHA512 8c346ff65ecb394a9fdbcd28e6ca34234062ae26303fbfa05917864d3c9873e100164d2cd5d6c814719417a41e83618183e0ba51966c4ac98f14978046c120bc
- SSDEEP 1536:7Apss2Hsc6JnmAjQ7LkkAyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQl:kpJVhmAoNCqfd7NtZL8cHQRZEQ6Sps9
- TLSH T114E31235A7D12F339FD1DB20B5134BDAA7B94595D434D201DBAD3FAB3983812A4838AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 ef1c59ddf6441ac88288e0b33045e65b1758d4937ea7a8f50b244476bd246658
- MD5 7c7da5e056d0c248009c661be629752a
- SHA1 72b9f5e0084599f57c1512fbcf2ad8fc8574811b
- SHA512 289bd1fb4f148177ed9f2758dead2186c30392a823808a4cb1410f91e105843d8f3f91b406f6de90f07f7c99b5f33247fc2f0f400ecd7c660eec3a2d1e268690
- SSDEEP 1536:6CyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Zqfd7NtZL8cHQRZEQ6Sps9
- TLSH T1BEC30237EBC21F339D82CB64BA534FDA57B644A99030D301AABD3BFB6C9345164424AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 d9f56f7b3910f9a64b44296414fcbcea9d28b5aebe98e8d45791502c972fa0de
- MD5 10cf739928a07616dc6a168ac3c72f77
- SHA1 501185ab1d00aee2d12224159998c2a06af341b8
- SHA512 bd5f716e72ef3b773149df931a3a0348dff53df2a0eafa50ef9f4137a9b9ece2a0323ec1e7cde51006aee696a313476e7517a12ca16c293c9b2eac04696d6ab9
- SSDEEP 1536:nOLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:O1qfd7NtZL8cHQRZEQ6Sps9
- TLSH T15FC30237EFC21E339DC2DB60B9130FDA57B644999034D301EABD3BBB689345564828AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 511234eaca97599ebce22497884a4c5d17a87844010a9d85eb935a7a4eace6c8
- MD5 186cba61eb8974da587fd00a247cf7bb
- SHA1 0923bcd1405dd133f9ca57806c4ffc2da2de3c6f
- SHA512 3029b6c36d5c9f91d8d559d60d2cd5fe76f7eb27dbb537e107da6087c8d067cd2dc3c9c8e0ebfeda5563f120c23e2a6f17950e1073641fac0be56b9a734e14d3
- SSDEEP 1536:6ihyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:J/qfd7NtZL8cHQRZEQ6Sps9
- TLSH T113C30237ABC21E335D92CB70B9130FDB97B644A99034D301ABBD3BBB688345565824AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 a8a62ca9c23f544fe8582a1f0fd68b8f4bbc9d821f67c372b207034d0c84d775
- MD5 280a88b5bfb1e3f5c13fcd778328ca57
- SHA1 a77f1d0939446288b92bb9c16b0979f914e0c554
- SHA512 8d50f291188987357ffad3e8816089a2cc0c9915458e275a64283d18328de358e58256dcea5d500af2fcfd8305da47f766c31ba9befaf3345d8f792a09f2882a
- SSDEEP 1536:7ihyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:u/qfd7NtZL8cHQRZEQ6Sps9
- TLSH T187C30237ABC21E335DD2DB70B9130FDB97B644A99034D301ABBD3BBB688345565824AC
- MD5 SHA1 SHA512 SSDEEP TLSH