Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
299s - max time network
303s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/06/2026, 17:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
300 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260606-wdevtsbv7j
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3284 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252420865338866" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1316 chrome.exe 1316 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1316 wrote to memory of 3648 1316 chrome.exe 79 PID 1316 wrote to memory of 3344 1316 chrome.exe 80 PID 1316 wrote to memory of 3344 1316 chrome.exe 80 PID 1316 wrote to memory of 3284 1316 chrome.exe 82 PID 1316 wrote to memory of 2244 1316 chrome.exe 85 PID 1316 wrote to memory of 2244 1316 chrome.exe 85 PID 1316 wrote to memory of 3804 1316 chrome.exe 84 PID 1316 wrote to memory of 3804 1316 chrome.exe 84 PID 1316 wrote to memory of 1764 1316 chrome.exe 83 PID 1316 wrote to memory of 1764 1316 chrome.exe 83 PID 1316 wrote to memory of 1424 1316 chrome.exe 86 PID 1316 wrote to memory of 1424 1316 chrome.exe 86 PID 1316 wrote to memory of 4404 1316 chrome.exe 88 PID 1316 wrote to memory of 1984 1316 chrome.exe 90 PID 1316 wrote to memory of 4612 1316 chrome.exe 91 PID 1316 wrote to memory of 3760 1316 chrome.exe 92 PID 1316 wrote to memory of 2472 1316 chrome.exe 93 PID 1316 wrote to memory of 3896 1316 chrome.exe 94 PID 1316 wrote to memory of 3896 1316 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8957c728,0x7ffe8957c734,0x7ffe8957c7402⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,15565473898680080992,16519967121995619859,262144 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:22⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,6810303865125362840,6707855532739916249,524288 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:112⤵
- System Time Discovery
PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,14485176694089742754,2089492723549387885,524288 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2760 /prefetch:132⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,12552074533857207714,17230708523265662303,2097152 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:12⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3056,i,1406685140830926949,8964526322588734475,2097152 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,3731191751241590519,12630922174959333121,2097152 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:92⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,8296736668934665387,13490969602871110650,524288 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:142⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,11503935742573427718,7451315396740860516,524288 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:142⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,15949433942775457048,9720929158720529966,524288 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:142⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,2702216879845489999,3110632023863249941,524288 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:142⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=740,i,17003704740470941692,11187114437312577366,262144 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:102⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1012,i,17653391091391066835,18034908345103228524,524288 --field-trial-handle=1944,i,2147489760903643171,2056674607848148191,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:142⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 3f768c24a0ddb0207b3b1d46bde6059f96cf14b44ab624039e80b0a5c669174e
- MD5 8e7853d0a9aeca7f9ffe39175d3c452d
- SHA1 1f46389b3934cb8e40bac86c22ea6185905ef299
- SHA512 b8d2ad751e69f44d0c44a2bf47e3f786a53ec0ea67afa436649907a1fcc96c41684d43baee8a3f44b72f3f6caf2dbd7b2765a1102d936c68df121203171cd449
- TLSH T164F078B6C820EC3B2CFD0B186064074AE75113173782898B3B3D920CCFB0A3B8A9582C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 5110b7c667d89b16d071a50b4f1b2e7b88599504ae4279981368b3a239bb5cde
- MD5 1adfece8076aa3557092ed85fa8484d1
- SHA1 6ae238aeebc1f74a37781b5a70d1a170045ebaf9
- SHA512 625056b60803516816f9e7b2f625202ee339abfd815fad77e225be4d0234b0c731f6dd3f3f7e69a26a53433de5250e6ec31a45ba47a49f909a9521a37e1b2f2f
- TLSH T19B5158F7C3D8867D890156F8AB256F1FCE2E0A14536D3D56C8D4AF0B93E2971D20158E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 5c22c917dc6874509f1af18e42093f78a7d1766fc4295765097413a60545915b
- MD5 3db9274d9c85865e4b0dbac5643faaab
- SHA1 c8eb881f5370d31271e0bdd9e2ccc9ea7f63d0f0
- SHA512 4f49cc1da2db1d680a4314f98607eb6c2bff67a6c64dadaea6a92365c62ee3f7c36a3308af1e035161511917d1dd62ed3028633e58bdfdf2f38bda8321824133
- TLSH T1765168F7C7D8867D890192F8AB256E1FCE2E0E14536C3C56C8D4AF0B53E2971D20168E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 9a9389d766e0f5edfb296ce97362157ebc7a2aa290878ed75052b9344955afa1
- MD5 91972afe6270700bff80084c1b5a07c4
- SHA1 5c667aaf8f404173a423c717e49a24aa539d9be8
- SHA512 61177e17217d835f587480e7ed730a0f5b9ed51170e98489872bf8f0b01889d739af7f836f676b3cca2d30f57ca1b4268bd9f8871e874bc0318db428ea964eff
- TLSH T12B6169F7C3D8867D890156F8AB256F1FCE2D0A14436C3D56C8D4AF0B93E2971D24158E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 2e3948a10cd656641acaab0d37042676533a043bbeff3cc02a8610ba3217a617
- MD5 a468e7ca0e626fc90915d169d16369e8
- SHA1 82f4f23b44af97fabfca7ed3091f696be1ab1838
- SHA512 60b1166aca3e37d5936c64c874c19263e6924b18523736e7cbc2307a576f356d0f7b84366d4d6f88c3d8ccdf4377c865c0f83b5603d9b262fec4db96b4dcb261
- SSDEEP 192:qRkJBVM2tBVv7lpAPRp2cI9+Hsb+WNnPmFP3bA0kwf0VyIsnAUge:qRkJz1lRUXO0wUPL9oe
- TLSH T19A42C67EAD14657B9CCBD22AFB253753D7F4202121D42E88EAFC8A2C05D79DC221746B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 89ae4e732f9ddd7e7f7795f7f2e32679b6120a894d18e39db99a23dfc272193f
- MD5 c2da7250400ebd9bead4177acf1b77b8
- SHA1 7fda5087dac142080e809225c5fba1367dbaa93a
- SHA512 fe2cc6b3ee7792f0f4a6a317ab1ee9ac29c8da29cece26fc5559bb6127878c77b0a9fd5cc0aa885755ef328b29e4e32b658810e9245e5990bc2651b6453617c8
- SSDEEP 192:qRkJ7VM2tBVv7lpEPRpicI9+Hsb+WNnPmFPmbA0kwfbVyIsnAUgE:qRkJ51lRwXC0wUPk9FE
- TLSH T1D242D87FAD10697BACC7D22AFA157B52D7F4202121D01E88EAFC8A1C15E79CD221746B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 23efb9e819c794c52a002f6aa28d8deff4a57b48ad32b2e95a672d0052b00cd7
- MD5 b2f0b275fe4ee70366af0f86bc80ada9
- SHA1 f7d0033d849a55fc34062691c62edc7858bebc07
- SHA512 40d404bea4cb0ac4fd8724d43a4a051ac1764b0988d50448fbfe9ee995cc756da3b4fd86af5718eda0d00aea5ce9617d2d5275d4c7594b212115052cf86c0c2b
- SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcMzOXODV0+ErU3O3MDTHGRjHj:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9h
- TLSH T1457208A76C488E7B0F94C5CCD8267A4FADB5025B65D9C86482FA582903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 a8cb1a9bdbff3525ec7e3cd07538117a718a9b161d13c6ed83b53880fcb7b45b
- MD5 6b91e63a252340c40fef1492659af082
- SHA1 bee9c73febe69719e181d00099a7923a3b0e9864
- SHA512 255375124aac05bd9a6cc80c30ae6670c070ee9a105a91d8df63a80c65d1c2d6ffb29c4e8dfaa9ad2378c782b0202e21a4fa17e0cbc75840f44261d983296d50
- TLSH T143B01256C0C1D152C80B03BC19C4988C7214FF10C6020333B9F837169C352500514180
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5947cd.TMP
- Size 96B
- SHA256 9c91e4eac0daa802b729ad5ce9742a98359df1ca75d49e2d81a38816307440af
- MD5 2b544e82ae0a91b65c1bb8264c06a00b
- SHA1 5218c8050b8009961830b3aa6f10a453462a3a03
- SHA512 45ee9f6809cd9b15d36dcddd2e09a35eba63cefeb1fb249f25d129c80db4ef44acf579ed5250fadd6c1f36db7f6798e8aa896b48c23456ad473952bdff23dadc
- TLSH T1AFB02220CA02A203C00203B028F0C0CC3020CFA2C2030222C2E03E22CC20A200ABC020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 a6623ddfb50be5a7e7d7b9a55646f96d65787b5e87cc18fc3d455b111a6fe34d
- MD5 d09a49fe0c357eb88e90c31a7919def3
- SHA1 2aad3ec10193049ea2cb0a8ccb82082ba9fb54cd
- SHA512 0f90b68d2b06160cf4c61f81989df8d8d890ac9e4a1c659a92ed3c38f535f979a6211c7aff5792c95a205bc6d1dab1db2949f1ba2f2224b26351f4ca0166ebc3
- SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Vm7Rkm1tYpBeh2BAoa
- TLSH T183C312375D74E97759B9B71EB08E0B2F1EF14AB7C920DE52C8D85B0423EA6CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 6b5236ac3984578897c5db06786b9db28f17f042ea365ae79b495c77b6b4d4ca
- MD5 6bb039b1c2987d27d4238f6ead85fbb0
- SHA1 79d8b32a72a6b7d598ec10ba2bcc25a259f57d01
- SHA512 5f2cefc526d5ac05a1b5f045f9fc53c4eb4126425686f0a9b9463d9ea2ca07b552bf638c28b9662a3da9f2aaa066c5b5144ec9075891a7cbccd605221e9826de
- SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:5m7Rkm1tYpBeh2BAoa
- TLSH T1EDC3122B5D74A87759B9BB5EB08E0B1F1EF14AA6C920DE52C8D85B0423FA7CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2bdd22a77c921a88295e63defe569f5567e5130baa37e8219b30184c1c770794
- MD5 b950bd81b0051305f5e3bb2d3a588a6a
- SHA1 10208e43efe5d6140e613f44be108be589830564
- SHA512 4f9f9e1d66605021decdc24908fb598285dd62d1f90a409ef80320d4d2227da46036afa3bb76a7efe384973a49d58801ded7ae5a909f5d67944e95cf0da57719
- SSDEEP 3072:HGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:mm7Rkm1tYpBeh2BAoa
- TLSH T1F4C312375D74A97759B9B71EB08E0B2F1EF14AA7C920DE52C8D85B0423EA6CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 bd985f46e64641381d56e43ebdd46dc409c39e4047d02984c60c74cc15e8b5fb
- MD5 409ac856af6c4d0f957409af19ba0f03
- SHA1 ce63e77e3c7f1e9b67b48678eeff9ad6dafd15d6
- SHA512 d95eb46b93f0db3ab73373a46c4785613de873437be1768a32fa86269a5b61cefe6af9f011c51a08f1e2b586acf644e5cbcc5bdc8de6e131b18accdac7ee14fd
- SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Jm7Rkm1tYpBeh2BAoa
- TLSH T126C312375E71A97759B9BB4EB08E0B1F1EF149A2D920DE42C8D85B0437F97CC0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH