Overview
overview
8Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
8resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
6resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
8Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 03:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260707-efkenaev2m
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4560 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278707139690039" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3448 chrome.exe 3448 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe Token: SeShutdownPrivilege 3320 chrome.exe Token: SeCreatePagefilePrivilege 3320 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe 3320 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3320 wrote to memory of 6124 3320 chrome.exe 81 PID 3320 wrote to memory of 6056 3320 chrome.exe 82 PID 3320 wrote to memory of 6056 3320 chrome.exe 82 PID 3320 wrote to memory of 4560 3320 chrome.exe 83 PID 3320 wrote to memory of 3828 3320 chrome.exe 85 PID 3320 wrote to memory of 3828 3320 chrome.exe 85 PID 3320 wrote to memory of 5364 3320 chrome.exe 86 PID 3320 wrote to memory of 4964 3320 chrome.exe 87 PID 3320 wrote to memory of 5364 3320 chrome.exe 86 PID 3320 wrote to memory of 4964 3320 chrome.exe 87 PID 3320 wrote to memory of 1172 3320 chrome.exe 88 PID 3320 wrote to memory of 1172 3320 chrome.exe 88 PID 3320 wrote to memory of 552 3320 chrome.exe 90 PID 3320 wrote to memory of 816 3320 chrome.exe 98 PID 3320 wrote to memory of 4984 3320 chrome.exe 99 PID 3320 wrote to memory of 432 3320 chrome.exe 100 PID 3320 wrote to memory of 3448 3320 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x9c,0x7ffbd53bc728,0x7ffbd53bc734,0x7ffbd53bc7402⤵PID:6124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,6754042531307893816,5521878787832792373,262144 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:22⤵PID:6056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,16522353862287488769,16438877399103618253,524288 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1564 /prefetch:32⤵
- System Time Discovery
PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,9938435542288462338,5653661413563824611,524288 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,15651633319382352962,12289769810994410621,2097152 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:5364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,11574117006946041066,3151043826337150940,2097152 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,15237950347424716974,17314410320233716739,2097152 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3932 /prefetch:22⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,9052944279834123402,5538112224136184497,524288 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:82⤵PID:552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,4997027997318020189,13410233444208912477,524288 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,7080054899620694886,7126690766515034340,524288 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:82⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,7517717770739719764,4620355787772100604,524288 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:82⤵PID:432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5280,i,7171599449255854469,15632950885861873120,262144 --field-trial-handle=1988,i,1218966237508218414,10726434902592732807,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3928 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 57432a82ad5529cc536ac231613ed3b150ab713a73f827fcc162668d07e3c0a8
- MD5 71ff7eddcef375cbf8ea2996d1b270e9
- SHA1 db8f6a230d9af26ecb17d747ece99768a7a2555f
- SHA512 65e73ddab787c2b2a26b8b8c08669a2a937907d8d426070ce1eaa6eebdc681f9afe33f0463a4e5abd18d0d7093dec6c0d4248430db3b010f56ae32b4af969d04
- TLSH T1F3E022EECA72DC3718FD171DA064474AEA5423073B40948F3B3C8A088FB563B468A85C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 3c570233df4ddf7dc106a20274c0f62b76f1af1ee4eef7f6d064c176d652f5ed
- MD5 6f8f92f82f02fbd3791123907cf1bc8d
- SHA1 7aaea3c02f591a8198e432f908911181585d8cff
- SHA512 3e9579a9942fb6ebfdfd6411efd3fdcee390f21c2c957bc94ea16e46c4a68ba581cb2b0a88b7403ab5dece92e2b0cc4f66368ec2e2b0e295301f453e47a6a8c9
- TLSH T123419FF793B4997E861192E4DB15AE1FCE790624131C3CA688D46E1B83F29B2D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c1ff9d90e0620fec4a2a163c71422fbdac55970508d3ffa2bd8d8591b53e0a21
- MD5 a2aa488887c0c7c690faf26ba436b397
- SHA1 94ea8f5e680e975e3d5020f74f2fe6d8ea34ad20
- SHA512 56a8c8a1b6b41c1ed1f89d93bfbbc3498264ca5fb79d2f08cc45dfb30195fcf033b20fde821a73e6accb475d67ee10f47be8a1f35b9985cbd89d2cc056d04ab7
- SSDEEP 192:5RHed/dXGdRn6v71hpAPRp2OJX92Hsb+WNnVgPqQekJpMpVyIsnAUge:5RHedRGHWBhUXxXQwmPBHGe
- TLSH T16542C62FA910697B6CDBD21AFD217B53D7F5102521E52E80EBFC8A1C15E75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 1df0393db9b74bf114b8ce5ce1b0594e82cce92f56887e1aafae6d0159de9bb0
- MD5 eca7a8f76a9df8f99d1c7c15dc82ee71
- SHA1 bf7ed385c1b469fd4ab8c3b66f7079296077fdca
- SHA512 c923e94e6c9091f2eeb4197beb3c84169d49d770f93b07681af7e126d22a313de8233b3cf1847c98740813ce3656385150501e0f600f91994e28498bf1e8f4da
- TLSH T1ADB01200C8419501C04302B41182188872146F15961E170143E06D32C83617180250B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5861c2.TMP
- Size 96B
- SHA256 b63d9e0c5e9806aac7f69a57125b65f624b8f2334f87b4e0eb33c6ad70b44dda
- MD5 19011b175d6dccb67cf21d61f321fd26
- SHA1 eafcb22370369422ea65c90a855c6d76e4aada6f
- SHA512 eff7ee5854b3f5cc04bf9c288786aa913c1e4d13f202f9c9851fc5f72dbff02db25d36e9996a6304213d01429a07088535e1d272e7346df68600a3235f12cdbb
- TLSH T1AFB00295C9036322C45203F426A59BD87560EF65C7431222D2F01A66DD656B14565160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 39658b71c14e0397c1a92901719360fa92449663273532093963bd86044a9195
- MD5 4c27ffca226fbcea786df97bee05741a
- SHA1 a8668117666310a865e8a0a26457702ab842b4d0
- SHA512 0e07b877b2be724c89485baf9062e098a5bf79f328cdf35d0b733bd8facc59c26897d074bc0f3800359e4b298ec696f6782dbfe030ffa3dd0619c131b6aa7712
- SSDEEP 3072:aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:9m7Rkm1tYpBeh2BAo3
- TLSH T166C3123B5D75A8375DB9BB0EB04E0B1F1EF14AA7C9209E52C8D86B0427EA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 f113251156239e473f362c764fc82c5a520e3ff9487fde041bed3c37b9b012ea
- MD5 6b424cf2e98022e119eac929c68d1bb6
- SHA1 7eb3e7e69a19f6314f94227bc057cdd15024a4be
- SHA512 8d4f6792d3f362db916d46bec0198033cb311f1655cef9699c060ec8dcf02b82f751ea192a1c7300d47b9aa422708b5be80dabe986c29275826e1c91f708493c
- SSDEEP 3072:+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Zm7Rkm1tYpBeh2BAo3
- TLSH T17CC312275E71E9375D79A70EB08E0B1F1EF14AA6C930DE92C8D86B0437EA7CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7a8c9a030a456b20b02b105b2ae248d5372294a9ca0e5367e34af8e31ef0f595
- MD5 09cf74eca6534d324b11091f0aab84cc
- SHA1 84becd27c95bb6750e84a3d0dbf966d45bcab447
- SHA512 8aaf3ee842d2fca903d06e1c23315f8a740ae4302880b0f91bdc0e8b90021bd4be6f9e8767d15027aed6d76b579c966a44fa87aa5be2cdde52e07b6b59f90ad9
- SSDEEP 3072:fGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Om7Rkm1tYpBeh2BAo3
- TLSH T188C3123B5DB5E9375DB9BB1EB04E0B1F1DF14AA6C920DE52C8D85B0423EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 f587f509a2b8082068e03defe670cfcbb6f7cad0ad9bc16c542ef2547df4f200
- MD5 54a0ba52e03237e81de02d28bea0fb02
- SHA1 1ce711f74e76a9d1f4ae0bc39e1dac47a162738e
- SHA512 3380d4efb2507d9959b949559b3c7c07f93bfc02932abd0fb441e786b7bc6479d56c8ec1bac0c346b8707177e5f80741351400d69bc383f24ba61cd21ee1c7be
- SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Fm7Rkm1tYpBeh2BAo3
- TLSH T145C3123B5DB5E9375DB9BB1EB04E0B1F1DF14AA6C920DE52C8D85B0423EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH