Overview
overview
8Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
8resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
6resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
8Analysis
- max time kernel
149s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 03:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260707-efkenaev2m
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2180 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278707031219021" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 2544 chrome.exe 2544 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1320 wrote to memory of 3288 1320 chrome.exe 85 PID 1320 wrote to memory of 5060 1320 chrome.exe 86 PID 1320 wrote to memory of 5060 1320 chrome.exe 86 PID 1320 wrote to memory of 2180 1320 chrome.exe 87 PID 1320 wrote to memory of 2336 1320 chrome.exe 88 PID 1320 wrote to memory of 2336 1320 chrome.exe 88 PID 1320 wrote to memory of 2868 1320 chrome.exe 90 PID 1320 wrote to memory of 2868 1320 chrome.exe 90 PID 1320 wrote to memory of 4816 1320 chrome.exe 91 PID 1320 wrote to memory of 4816 1320 chrome.exe 91 PID 1320 wrote to memory of 4156 1320 chrome.exe 92 PID 1320 wrote to memory of 4156 1320 chrome.exe 92 PID 1320 wrote to memory of 1020 1320 chrome.exe 94 PID 1320 wrote to memory of 1148 1320 chrome.exe 106 PID 1320 wrote to memory of 4192 1320 chrome.exe 107 PID 1320 wrote to memory of 4212 1320 chrome.exe 108 PID 1320 wrote to memory of 2544 1320 chrome.exe 110
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdbac0c728,0x7ffdbac0c734,0x7ffdbac0c7402⤵PID:3288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,2664325492489193603,2920221455210864887,262144 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,10428422798036234580,10827482545310623707,524288 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:32⤵
- System Time Discovery
PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,15805220173688719370,13813778714557950688,524288 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,6164559789717262000,11635837457270342126,2097152 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,4034181263768370612,17448179997135749267,2097152 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,17507589711811799739,6344843263855730242,2097152 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:22⤵PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,16598128141061771420,4165145240995242421,524288 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5248 /prefetch:82⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,7391089699110500990,11496110722083802262,524288 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,12020969973054111758,16027395675709800357,524288 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,1025790406482691473,13670703304318969035,524288 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:82⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5324,i,12704372837658458536,15580049261695341619,262144 --field-trial-handle=1952,i,2862509106296809905,12254047456192132949,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 18f75c01a4b4f09d556826029c0f4cb9a7b364bdf124016832f89d16685f4ddc
- MD5 9c9aa4b54683087c0a37d6434ec6282c
- SHA1 f5a203be1e440eb32168a732a59f83591f2d7ed3
- SHA512 644267a42a400fe4c2b9507cd7bbc6cdd0f7b4cc3b2d879eb88d104d44269e7b6d014b35d5fa267779a930db0583fd6aa2eca4938d2ad29fd517467ca6c6bba5
- TLSH T1E9E02B9EC925EC275CFD4B2D505C474AEA1023571760885F3B3CC108CFB16B702C585C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 eb5e4204b9f6582d1f233a254efc022746dd984849c017d9b8636acd5fbd00ea
- MD5 1dc22cb7f413f1bc8a155aeb81033fbf
- SHA1 660dde414e44dc1a0e4f1d26c9b910076bdd80a8
- SHA512 e4397e274fd5e38fe3ec5d35ef39f75f93b5272ccac540d9504d4e3045ffe3a01415334c6a11a9e3a810301ce3bb5113869112ac518bb07e1d9213ffb86bdfcf
- TLSH T105415BF793F4997E861196E4EB156E1FCE690624031C38A689D46E1B53F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f54529a8f34d567d6ad6ae365fe52e630756a37a6e5428dec3889087d0c80142
- MD5 6a989bb1f6f29ef28905bbcc7b56c8d5
- SHA1 f1a2539c14a7f9adaf7f32252bf896341f5ab0e0
- SHA512 500cb1163ba7e5109baa801e1d5b8fdc7a2626804a832f89cff545ad1bcf5d0a23d5ca8f69f9216ded4434676e87794a714e02704e901cc52eb94b59e60b5632
- SSDEEP 192:IR0a/WMvdSz8uP8v7ApAPRp2hM9qHsb+WNnU9PzteoeBMGVyIsnAUge:IR0aOmdSfokUX9kwSPbQre
- TLSH T1A342C62EFE11693B9CCBD219FA657B23E7F5103521902E84EAFC8A2C15D75CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
- MD5 28aca1b912d001e337a9e715a111a353
- SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
- SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
- TLSH T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 bb55512dc4159ad4a69711cce226bb39c79ed3ff773678014d88f1e5695fe908
- MD5 f101e45674df870809edf2e15f22e295
- SHA1 8d2f3492471d9a5a51dee2f2282497ef59f991de
- SHA512 0dfe4acb00283f86f3f2fb314b30f24327db7b212348d757ccae4e20dfaa83838e76b06570f78c21a2fc33c541577d0ef4c8e04248c4ad0cfa33c9e38463b337
- TLSH T16FB01201840A7222C05F02B0225324887114AF199A0B170D83E47A26D8655718414090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5915a1.TMP
- Size 96B
- SHA256 8ea0def7de1a59eace641889219faa54cba701148663b5abeda73803eafa5725
- MD5 bccf5330ba4414e351f36a02365681b7
- SHA1 23cb29ed2e0aa537ceabca8408c9674d5f960823
- SHA512 aa204bd212b3fe0ec840324db7d9222db90dd2fae320d7a9ec2f62585fe057f4f349963bae79e4a5f3cda6f4d6a0eec97f6d2d12901be220de191bbcf2da32e3
- TLSH T1C8B02200C2032202C02203B0208080E830A0EFB8EA83028383F80A33CC2E2308020020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 c4fbe3ca1ceeb78153260a6b3dc0bcdfe2e710704f5a499e3e33733469015f7c
- MD5 33e611a7203214e5e34e58c71d76fdd7
- SHA1 e8b7c000fdc143b14c7b2d7d4c89def8093964b5
- SHA512 d4bbf22db973f0a27583b90d0409315d66d0ad5af045c127ffe1bd3c97bea884f955123ac133940dda5537d024421d914462ec5082bc130166bff924ca682b8e
- SSDEEP 3072:ZSGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:fm7Rkm1tYpBeh2BAog
- TLSH T196C3023B5D75A83759B5FB4FA08E0A1F2EF24AA7C920DE56C8D85B0423F97CC1A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 c22f49e92e3ead832a4a48350ffae49b0f2982423d288a12dd36b75cc1a9371c
- MD5 6e233f05abab5efc75b1b4c0fb24a75f
- SHA1 9dddbf749485d17444b4c575fceaa2b1339934d6
- SHA512 afd1d0a03abb5dcef505dc1d18b916794284f54ad1210453c96fefc3057810beb9263d260e4c07d04fc5d3d413970255ac852efc7cf2f34b0abb53243703fe7b
- SSDEEP 3072:K0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:cm7Rkm1tYpBeh2BAog
- TLSH T1ACC3023B5D64E8375DB5B75EB08E0A1F1EF249A7C920DE92C8C85B0423E97CD0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 9e37b665fd0fc91927468f999fbb357c6d2fa75c6c2c46f74bfa86cd3fca7ceb
- MD5 723b0ef8915edce949f94c0fd0bff7d2
- SHA1 56cafb3741790d20528dd5de252688aad0ebcf48
- SHA512 09fbe3bb137d498f9ba39ab6b9259c63167248778d2b93b40b1c189e341ffc56e84ea28fe287b189ce5b97e95e5715b37a27f76d96ad13d4b8a4a98842f98855
- SSDEEP 3072:AdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:zm7Rkm1tYpBeh2BAog
- TLSH T13EC3023B5E75E83B5CB5A74EB08E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 43d88ae3bbeb30253a9936afcb81c35496e0e5f1b8fabd05fa8adf06f5f7da67
- MD5 9b7f853dba10f8b0554dab793e4179cb
- SHA1 dad48b91537804a148ef247eed26b3a542cf6e12
- SHA512 7ed310ebbdb877f433ea442e00a352013ab2725133a6642cf98d71df484abf23e4e58a9a12c0f05d18e355464881df1767ef717af7f285d2be49da234de5d718
- SSDEEP 3072:Z0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:xm7Rkm1tYpBeh2BAog
- TLSH T10BC3123B5D64E8375CB5F75EB08E0A1F1EF249A7C924DE92C8D85B0423EA7CD0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH