Overview
overview
8Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
8Xeno-v1.3.55.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
8resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
8resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
599s - max time network
606s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 09:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
38 signatures
600 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
17 signatures
600 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
600 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
20 signatures
600 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
600 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
600 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260703-kzddcaet31
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6020 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275431715480434" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 4488 chrome.exe 4488 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe Token: SeShutdownPrivilege 3832 chrome.exe Token: SeCreatePagefilePrivilege 3832 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe 3832 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3832 wrote to memory of 6132 3832 chrome.exe 84 PID 3832 wrote to memory of 5768 3832 chrome.exe 85 PID 3832 wrote to memory of 5768 3832 chrome.exe 85 PID 3832 wrote to memory of 6020 3832 chrome.exe 86 PID 3832 wrote to memory of 5904 3832 chrome.exe 87 PID 3832 wrote to memory of 5904 3832 chrome.exe 87 PID 3832 wrote to memory of 5268 3832 chrome.exe 89 PID 3832 wrote to memory of 5268 3832 chrome.exe 89 PID 3832 wrote to memory of 6100 3832 chrome.exe 90 PID 3832 wrote to memory of 6100 3832 chrome.exe 90 PID 3832 wrote to memory of 5972 3832 chrome.exe 91 PID 3832 wrote to memory of 5972 3832 chrome.exe 91 PID 3832 wrote to memory of 2208 3832 chrome.exe 98 PID 3832 wrote to memory of 3264 3832 chrome.exe 105 PID 3832 wrote to memory of 5284 3832 chrome.exe 106 PID 3832 wrote to memory of 4708 3832 chrome.exe 107 PID 3832 wrote to memory of 4488 3832 chrome.exe 108 PID 3832 wrote to memory of 2284 3832 chrome.exe 112 PID 3832 wrote to memory of 2284 3832 chrome.exe 112
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd0cb0c728,0x7ffd0cb0c734,0x7ffd0cb0c7402⤵PID:6132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,8141541615387429382,7284563338985346234,262144 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:5768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1556,i,17328223684434348179,917113336813640953,524288 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1552 /prefetch:32⤵
- System Time Discovery
PID:6020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,6378303473400240711,2859587984109474850,524288 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:82⤵PID:5904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,8588693794130460847,705403973276009159,2097152 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:5268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,17309695460710597865,9189514427109316055,2097152 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:6100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,13884719451725064489,17358018587593965052,2097152 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:22⤵PID:5972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,9931728696992306994,10740237712588014035,524288 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,22635703882168947,2092655587848871167,524288 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:82⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,675912457393295009,7365243943940561531,524288 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:82⤵PID:5284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,11515807198455437655,3917596869160475809,524288 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5528,i,11975038220330342898,16379698256286944166,262144 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5204 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,10210541078444369535,16952929247864455139,524288 --field-trial-handle=1976,i,9347370307902733116,10580094659301320208,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 4f294856fa8997d300c0cd22e2df14d4de9f24c3cefa87e451837601bda0561a
- MD5 1f8a09f8ad033057dd1c1be27ec46ea5
- SHA1 59c046b6f9f3afee8749dbfe23fea0e2c91ea886
- SHA512 a2c69a9886bb83606124c928b5a38cb87778c86081f78e989995b49ee988796ccdc58705a4020c90a0d314dac7262f127dadf59498f450d39034507b017f263a
- TLSH T1D4E02BAACD62DC3719FD0B1CB0500749F7541B473B50858B3A3D85088F7563B464B85C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 52fb53627a783de1cb746e286a245149dc2ea24231ba200ac276e1339bc5d6d0
- MD5 1f93e780e08c32d08e6275d4f8371114
- SHA1 30d0f823ccd9cdd0ecf0916ec6bdd9b04927b203
- SHA512 1bb3a06e50711f1b2eab6329d47a4d458640e2235694821510381072cb6126e3ca88119296171fb7508c5ad4692d049a48e8dedaa58fee3a4463ffcb4ed7d89c
- TLSH T1BD419BF793B4957E8A1196E4EA156F1FCE690624131C3CA688D46E2B47F2872D10079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 d917fc928d3b5c23dac52764f6b2da4605d05f2b1fb526a78998c7873c448ed6
- MD5 def60ebdae0612894b430ee271ac3322
- SHA1 ac9ac2542e525050bd14215b9b19001c71b03093
- SHA512 ac462bab55e093fc72d151e3da5dd053f4ff1cf327157a1241743bff22e243eb18a9af7a8df5bb829f3a66c0c0e8e9f06f8ed23bc9f17635f656ac9d6d33794b
- TLSH T18E418AF793B4957E8A1192E4EA156F1FCE6D0624131C3CA688D46E2B47F2972D10079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 ed598cf0dc5fb13ffb09007511b115acc7c1cebc47904472853afca483e94705
- MD5 2f8e5a608d3432e649c586d7dce33772
- SHA1 9b32f6183f333169f2494964bfc5b0e79ca5c65b
- SHA512 36daa3784b2fece94da768d9fbc6060787e1b85644b51f6f97c83744a5f0cec81679b47b912a50b3d95d2931272997caa47a405105259d5de57740e7fae19455
- TLSH T1C741ABF783B4957D8A1196F4EB156E1FCE690524132C3CA688D46E2B87F2872D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 044dfae8623da86dec864eab43e1c9c0dcffec4435abe15aca031048d97bf72a
- MD5 a79c8492a30cb94fbda6e7259b8dddbd
- SHA1 a8bd6727477d3c42a2ebd833e93ab4648d9a7d63
- SHA512 42cfda01a5248c2288a3dd9f99851251a8cb89eadf94614030e77d1d63d1262d5578bf1909e70b467299ab3feb20a97a8c4d36cfc9a5586932e2a53e481c0d5e
- SSDEEP 192:5Re5gwYKCDAWv71hpAPRp2OS92Hsb+WNn1QP21mkwnKlFVyIsnAUge:5Re5xIkiBhUX6QwWPCmize
- TLSH T12E42C56EAE10687B6CDBD21AFD217B53D7F5102631A11E84E7FC8A2C15EB5CC222740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 6d46b671b06a8704efbb5868ea61f9d8d74fba551359da19fd973780469811be
- MD5 941c6df2477c0ae9997bd491fa678139
- SHA1 45ad36c12518195043cbb7ae979a8a2910b12505
- SHA512 4fe4fb838b5ec6a2043909192196fa593e6c922feef1b730a4f6b5b0fccab58ea0fddc9abaf13cd8c4d3234b2ac4131c4589b2036ea057fd79d37abda91a65b0
- SSDEEP 192:5Re57wYKCDAWv71hphPRppOS92Hsb+WNn1QP31mkwnKFFVyIsnAUgE:5Re58IkiBhvXnQwWPFmIzE
- TLSH T12F52D52BAD10687B6CCBD61AFD217B53D7F4102621A11E84E7FC8A2C15EB9CD222751B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 6a61c95a553a68f0274d81258b32dff18ad3071d7ac1dbe62c213ea616c205f3
- MD5 a7af26c5618227a4e94e91b9739cf176
- SHA1 381ca588bcfbdcd76cc3110a571a599b6c275503
- SHA512 2184dba0aee0f9f634934d851e4daf95ee2fc0c11ce91dcdfb43d690f335e19a40835cde7246f64e795a746dc2b5fef76c9cc8e1d0318187f1339fba956ee779
- TLSH T148B0120088426123C44202F05652548C71545F109A0A1B0143E06E26C8351618119150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d126.TMP
- Size 96B
- SHA256 5b9d2e6fa311136806a729b579b0a0332e6f3e582d6096266639d2f049d6f5e6
- MD5 8b189787267572864630f484316d5eee
- SHA1 eb881d70928276340eb87337563093541a6b31be
- SHA512 dbcc22a2054cec780a626b15836f4f161d5a204f825dd7181e989d9b93e8da4314abcac43278b923d937d5b1f90505bb92739e678818941c44d71181a083433b
- TLSH T146B02232C08A2202C00203B022C083EEB222EF30CB03020282E00AB2CC32B300C32220
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 dd89ab32fce6fb114dfc1bb182fb2f2683f04e906da534eb6c593e5d40611d65
- MD5 341ac268434e18b7f79688e40c426549
- SHA1 9266bf129b907d4829d64af373c3aef1875f9ada
- SHA512 07d239612e74e1d87cacd33c2b796ec93d8636ae97c547b01102426c20ddda5b784ec9afa3549e7b639d88a222e3620c75d62cee5abd6f066b03b103d59e2c84
- SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:lm7Rkm1tYpBeh2BAo3
- TLSH T170C3023B5D75A8375DB9BB4EB04E0B1F1EF14AA6C9209E52C8D85B0433EA7CC1A45D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 717c86ac25c8ae82910376125034dfcad37b2a8cfa8dbf8c4f2c0f66d39c07d8
- MD5 72de61c26a10c3b288c8d778dda671ca
- SHA1 bbbb350510b4303ab8947d032b1f0acb82c555da
- SHA512 f4f4446558b75fff1e2394ece0eca6da18de94ba5fe7010d52c09054cfdc8bf6bc81b748d4194a54d43142b824f63f74a544750d128af728aeaa407bcb3d697d
- SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:dm7Rkm1tYpBeh2BAo3
- TLSH T113C3123B4D75A8375DB9BB4EB08E0B1F1EF14AA6C9209E52C8D85B0433EA7CC1A45D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 655cf8494cf33416164b4fe31c3ddf2cae261ceaae607a818d6770675c84fdbf
- MD5 d68290a3e8be5708da241d80f5968f8d
- SHA1 b5c1ac2c3ef44f8e93aff653756c9102cd1fbe13
- SHA512 76eb3450074564c514a8bcb6c214a557491d54b4f371198b107e70d7b49bccc752c56f3bdc3b55a1d0359bef69d4045b442da4b838ef6cf0fdfbdc860090089f
- SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:wm7Rkm1tYpBeh2BAo3
- TLSH T12FC312275D71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D86B0437EA7CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 8c11682720f931253f7c164788b1dfdcf01c2020d0ad38fd22355e3061d4aae3
- MD5 02579ffbf2c6c76a5a66e10ad50f17be
- SHA1 a1673b1c6881505755970ca2de5610a371fe8f90
- SHA512 13953aa87a61b57d963c1d70ad30b87fe796445a9c85d8201dcfd21a1b267c94ab431830e38e5da34ee1c46e55c6ade503dd50887c17b57e877712c25770df98
- SSDEEP 3072:JGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:om7Rkm1tYpBeh2BAo3
- TLSH T1D1C3122B5D75A8375DA9BB5EB08E0B1F1EF14AA6C920DE52C8D45B0833EA7CC0A45D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d5fe060c9878f1ab6f477a16748a395da4394d444eccab4baf574d42029dd4a9
- MD5 dd0ced8e4fc3a83d3c5e165aa6dbfc2d
- SHA1 1191996c2bb3fa78c59a22123d43f60ece5c6c74
- SHA512 63ab574ee23172dd92829de858cc7b714099fd68961e7f4e3cf01fc15183834f548921f030c3bbb33481c9c894f810aa50b4cd051589a1e5bb700922dc608765
- SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:bm7Rkm1tYpBeh2BAo3
- TLSH T189C3122B5D75A8375DA9BB5EB08E0B1F1EF14AA6C920DE52C8D45B0833EA7CC0A45D34
- MD5 SHA1 SHA512 SSDEEP TLSH