Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows11-21h2-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...rt.dll
windows11-21h2-x64
1resources/...se.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...b1.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
300s - max time network
310s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/07/2026, 22:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral5
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral20
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
resources/public/libssl-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
resources/public/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
resources/public/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
resources/public/msvcrt.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
resources/public/ucrtbase.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
resources/public/vcruntime140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
resources/public/vcruntime140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
resources/public/zlib1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260708-2k4enaa16w
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3092 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280243580437084" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 1760 chrome.exe 1760 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe Token: SeShutdownPrivilege 4944 chrome.exe Token: SeCreatePagefilePrivilege 4944 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe 4944 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4944 wrote to memory of 3408 4944 chrome.exe 79 PID 4944 wrote to memory of 3172 4944 chrome.exe 80 PID 4944 wrote to memory of 3172 4944 chrome.exe 80 PID 4944 wrote to memory of 3092 4944 chrome.exe 81 PID 4944 wrote to memory of 4576 4944 chrome.exe 83 PID 4944 wrote to memory of 4576 4944 chrome.exe 83 PID 4944 wrote to memory of 1456 4944 chrome.exe 84 PID 4944 wrote to memory of 1456 4944 chrome.exe 84 PID 4944 wrote to memory of 2076 4944 chrome.exe 85 PID 4944 wrote to memory of 2076 4944 chrome.exe 85 PID 4944 wrote to memory of 1704 4944 chrome.exe 86 PID 4944 wrote to memory of 1704 4944 chrome.exe 86 PID 4944 wrote to memory of 2872 4944 chrome.exe 88 PID 4944 wrote to memory of 5052 4944 chrome.exe 90 PID 4944 wrote to memory of 1528 4944 chrome.exe 91 PID 4944 wrote to memory of 3280 4944 chrome.exe 92 PID 4944 wrote to memory of 1760 4944 chrome.exe 93 PID 4944 wrote to memory of 2088 4944 chrome.exe 94 PID 4944 wrote to memory of 2088 4944 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ef59c728,0x7ff8ef59c734,0x7ff8ef59c7402⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,537740002314263829,6223563264671259115,262144 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,1707418899590901473,3401160809952242103,524288 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:112⤵
- System Time Discovery
PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,3056762297242275274,984796963160514661,524288 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2768 /prefetch:132⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,1500864646463518148,3820983445188933748,2097152 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,3665607570425146957,1800449495079389048,2097152 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,9137382254079600457,2488553040460316667,2097152 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:92⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,11402727840663908285,7953348229684185629,524288 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:142⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,14793998279824493516,15927249705967658487,524288 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:142⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,9786089636288370366,5458202116965165195,524288 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:142⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,15958916885525225377,16960757312217750193,524288 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:142⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4280,i,7507067791342506903,18380510657166521049,262144 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,5604647770626509452,3298125500681633706,524288 --field-trial-handle=1976,i,14112726861230953865,4399875657637189106,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4556 /prefetch:142⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 44cede89bcbcd177181d8964f911f3402cfcd73b109b744de53b0f776c5398f1
- MD5 85524d5aeff5fdd4c3bbf5f940c7137c
- SHA1 02f91fea01061fffa0b0f942adb9e4d7c6890783
- SHA512 c0c5b0e2f91ce3145d5a837dc96a6f52bec85a4305b0b7487cb6dd3d972f5fe69bf6fe632ef49577f2a743a0b8c19c8120ee77afe2a61eba74ce9d10dfeeeaab
- TLSH T14EE02BB6D921DC2B2DFE075950164645E70013073741994F7B3D9208CFF563745D185C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 992d7982e4a0859422b525a4c65f53c67cbe1b4ea5c3a8c3fd9bf788800464cb
- MD5 23ff6270f30f2deb68cb4320c67ff44b
- SHA1 c57972d264e4df44b4478e0f0d9df37a2ad06df8
- SHA512 3f9aa3ccb33aeef37969afcab4f0236b1abe1640c80c67d2a6393db61991c8585ff959d8da30873f1ad6b8f0482f0bbe42c0510b9c672e69b8ce18c165603a1a
- TLSH T1B1418AF797F4897E8A1192F4EA156E1FCE690524131C3CA6C9D4AE2B53F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e1ca4a4c50920f0bc4b53d8889366a06b175569468bff10b41a861a3b14fdd15
- MD5 67c74c9f4e1b8a263a87b40217350bf4
- SHA1 ecaf6230b4bd38e3b9c64144c57a14751c2011fd
- SHA512 f6e62b94a62156ff90f6b562dfcf29cb87eaeb497f155e038b50bf116a5beac29c3d587e5178d60b81cc66eacf1c68b608bc739ce96de3eee193ad0daca2f96f
- TLSH T12241ADF787F4857E8A1196F4EA156E1FCE690524032C3CA689D4AE2B53F2872D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 69bbbdb4128924607780c9320f1c79602a45874723a08e938ddb150eae1ee17b
- MD5 09a6bf8ac17e1e564e5c6db950bc0a05
- SHA1 47391cde43cfc9cc206664ba028a07b908cd54c5
- SHA512 b066fe11032e58337fcab1b02fb36eabd4e0bf18d30fa21d8776447ce0dd5405ce013504c9f1e81020a74be974b4202a4d6a1147774c8dcbcf9dfd39625f5f31
- SSDEEP 192:qRKNC9vf4v7lpAPRp2c89+Hsb+WNnRgPPKl26rCxkwsaqVyIsnAUge:qRKN4kRUXe0wmPPG26sMaqe
- TLSH T14142C57EEE15247B6CDBC329FA163753D7F9102121842E88EAFC8A1C19D79CD222745B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 df52374d74588639f283d3493c3f016671521be2b9414453b7c775616d01eeaf
- MD5 35e90b4746a957713d4d53362224576d
- SHA1 deb47ec6f92ddb8790173cc225bb247c68d4df8e
- SHA512 f4d92e46f44a0b878ffa923f96843aac87685dbf9d04e08ce74a63972da5c3ef0430c50300143f2fb1ae5493bd46528a548b731ff23e6d0e6520934e43539d1e
- SSDEEP 192:qRKND9vf4v7lpQPRpqc89+Hsb+WNnRgPPnl26rCxkwsajVyIsnAUgE:qRKNRkRIXy0wmPPl26sMaFE
- TLSH T1F952D66FAD14287B6CDBC229FA163753D3F9102121942E88FBFC8A1C09E79CD221745B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
- MD5 9365e110646fce4577746230e9396c69
- SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
- SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
- SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
- TLSH T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 2065ee387fdcde9dede417381150721a168cd9117cc06b2dda4dc5216e4dee66
- MD5 87a980bd69e73276544ba68f5bc1905d
- SHA1 3afe1c320d93ed8ef794308c3d1b757e7c1051b5
- SHA512 e1fed541d1b47fbc323d1de84c0ec239227036c5396622063be53269398d95dfe1ab0c6b0c040fd3e78c9ce38000eba8f3f86dec1eb3685acb44bc9f6059c861
- TLSH T13DB01250C4026101C10602F41243B8887258DF10970A1B0587F06E32D8253508214060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ced4.TMP
- Size 96B
- SHA256 4e50ecb7e52116da61d9484ff4042a492c0ede4417c9486b37440cac71722437
- MD5 5ce06dc129a325c7e60ebbee6bba370a
- SHA1 c9c23adecf9f50a7fb782979af3632157a2ccd0a
- SHA512 bf62a5434dde9861cf4c6778f42e0dac69e6376760bcee80ea61af9df648cac5b7d84a34c1c5dcef85af1ddad1ec2d49b8a2d0078d2c2368733d4bb23cd234ff
- TLSH T1B4B00255C107631AC14237F439DA95DCB164FF25C703222AD2F51B76DC3A6648526660
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7c214de46eaa2f48b8cb6e33666aee3aa8f33ebbdab9c2c832b549667d5281b5
- MD5 d1dc5c852b700412a5748be92a37dbb4
- SHA1 1734805a08ffa7cb0f4ef593a4833c007ec3adea
- SHA512 0d76d74189752601c57ec191545d9382cbd38ad0a966d26996a2ca503628ea464601839339d5df48267e97522cde7807edcdba568ea051bc5f7d76f65990d30e
- SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2m7Rkm1tYpBeh2BAoa
- TLSH T107C312375D74E8375DB9B75EB08E0B1F1EF249A3C924DE92C8D85B0427EA6CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2aa5fa4a1a8a64e6e6fb29ca29734dd8832d53b3dc17cf873275d5076c50846a
- MD5 2cbe1407ecfa3b9525ba2425a9fa12d2
- SHA1 702299501d686b103ff2c5d661c51427bffb0f21
- SHA512 5796020463d624f1056de468d13404760fcd783960355de91fcf11d2acc35fe4212ae2e0821142fda93757ea6d30cfc818fde886bee7c6f33cd823c0ca35b279
- SSDEEP 3072:DeGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:D5m7Rkm1tYpBeh2BAoa
- TLSH T1B9C3123B5D64E8375DB9B74EB08E0B1F1DF249A7D924EE42C8D85F0423E9ACC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 a49012208c1fefab8f0598fd5df46781c925ed52693ecc6e813909ad6e5a9a57
- MD5 4115f4d32bf28ca1a0f152a06d7485dd
- SHA1 6e2788de824a0d439cf2de9d7f582731c06cfa62
- SHA512 e63c7eb50a75f38e562b010a8d09584ef92ffed43339c397b9040de20fe1ee3096db3dcd22eb04329e19b95e61217b74c4bf7fae45e6595c63e64bde46c2b6fa
- SSDEEP 3072:YGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Tm7Rkm1tYpBeh2BAoa
- TLSH T1DAC312375D74E8375DB9B75EB08E0B1F1EF249A3C924DE92C8D85B0427EA6CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 d48b77102f3d97c3c76f41de8ae86e234d6489588f848aeb4d7c769acc8051f0
- MD5 a5239309580ad01529a0d1a0ada134d0
- SHA1 a8d2fc2f4bee81b6ba44a755fbb796a3298e9a6d
- SHA512 720cd82bfdef3c8d0e3df2742cc781d4a2947f01348b14faa92adfe608ed38f9dc11d56335cae31d922faff1496e84ff20825c2382d5c88d4393ab9ee61b7604
- SSDEEP 3072:HeGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:H5m7Rkm1tYpBeh2BAoa
- TLSH T129C3123B9D65A8375DB9B74EB08E0B1F1DF249A7D924EE42C8D85F0423E56CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 a8ac4bf5604eb3cc2cd8a1954f9c5fc63fcff75fde00a6058d40f9b944c44f24
- MD5 df71a113eabd771eeb26804a25565a50
- SHA1 e22b0ca599f1f4887ea6b6ef2a1b691b2f4bb4c4
- SHA512 4c0b477adf438aa5ccfce9f54ce4f50f9163d07b25918a83c30264370a3eaff073b4e299980de5698f2032513912b2db82be87678b73ecd452b8965681f8d579
- SSDEEP 3072:sGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:fm7Rkm1tYpBeh2BAoa
- TLSH T116C312375E71E97759B9BB4EB08E0B1F1EF149A2D920DE82C8D85B0427F97CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH