Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows11-21h2-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...rt.dll
windows11-21h2-x64
1resources/...se.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...b1.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
300s - max time network
311s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/07/2026, 22:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral5
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral20
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
resources/public/libssl-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
resources/public/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
resources/public/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
resources/public/msvcrt.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
resources/public/ucrtbase.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
resources/public/vcruntime140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
resources/public/vcruntime140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
resources/public/zlib1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260708-2k4enaa16w
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3324 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280243509868937" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 404 chrome.exe 404 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1236 wrote to memory of 4780 1236 chrome.exe 80 PID 1236 wrote to memory of 4768 1236 chrome.exe 81 PID 1236 wrote to memory of 4768 1236 chrome.exe 81 PID 1236 wrote to memory of 3324 1236 chrome.exe 82 PID 1236 wrote to memory of 1620 1236 chrome.exe 84 PID 1236 wrote to memory of 1620 1236 chrome.exe 84 PID 1236 wrote to memory of 2160 1236 chrome.exe 85 PID 1236 wrote to memory of 4472 1236 chrome.exe 86 PID 1236 wrote to memory of 2160 1236 chrome.exe 85 PID 1236 wrote to memory of 4472 1236 chrome.exe 86 PID 1236 wrote to memory of 2380 1236 chrome.exe 87 PID 1236 wrote to memory of 2380 1236 chrome.exe 87 PID 1236 wrote to memory of 2060 1236 chrome.exe 89 PID 1236 wrote to memory of 3876 1236 chrome.exe 91 PID 1236 wrote to memory of 1584 1236 chrome.exe 92 PID 1236 wrote to memory of 1728 1236 chrome.exe 93 PID 1236 wrote to memory of 404 1236 chrome.exe 94 PID 1236 wrote to memory of 4796 1236 chrome.exe 95 PID 1236 wrote to memory of 4796 1236 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff9bd7dc728,0x7ff9bd7dc734,0x7ff9bd7dc7402⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,17011710634749833038,4430210540437652654,262144 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,16995349862996695426,11426574731546800043,524288 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:112⤵
- System Time Discovery
PID:3324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,2459541392515160576,17656133529636909983,524288 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2936 /prefetch:132⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,10522368814710896351,2932423146225218326,2097152 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,10202073456862855196,3727209715063597342,2097152 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,8911412436651649705,16732458426632224554,2097152 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4268 /prefetch:92⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,11982813800104423001,10341017086322074760,524288 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:142⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,2294190893836604109,7233193466593909496,524288 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:142⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,5512879540365760116,13897114083386274027,524288 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:142⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,14213471680422739916,12473755197342474571,524288 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:142⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5220,i,7789973800997052822,8069829518022808582,262144 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4252 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,16744035820494728667,11469998221685330671,524288 --field-trial-handle=1952,i,10074108835822780899,1267525315752347116,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:142⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 001874498181137d619b5167f21875b9ed120631206d37bfb5d36d00083df3da
- MD5 851dfd135c62abfdf0baa138e388465c
- SHA1 b969f3c43ef035f1dbda1bd59a2d7a7bc1259604
- SHA512 fa575c1e58745f88ca83506cd43e88281dede05337020b602d993d111eb936bbe21094c780724a05ac9f49437fea778efd9ff5f12a223fbf55b8196defd8cdc5
- TLSH T1C2E02BAADC36EC3B18FD276960515786E75013171B40590F3B3CD1098FB5A774586C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 f77556c5e6eea0307bfd5e0efa110ab02bf23d65fb5115eefdbc9a3a0ad22323
- MD5 eb320267b22bb09730547f286aefbbd7
- SHA1 d6bd5904d2e236c4849a8f68e5b089975627f042
- SHA512 ae3a5dfc306e53d35c066d32f91c510e6a9962b5b9515699d16c8376ae68ce02f445be8ba8941924c9a6cabba55cd1f54ad9cfc3bf8fd476f664c33ce0f3b323
- TLSH T17C41AAF783F4957E8A1196F4EA156E1FCE690524032C3CA689E46E2B97F2872D14078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 11fcc9578b1a98508d59ab4cbfcb75219cc84ecc68814c531b0ada46d8eb2410
- MD5 9345a2765e4cd46a41806dbc234a96d8
- SHA1 e2ff45d03a104f01fee745c0d5b3f1eca2963575
- SHA512 b197ceffd2a3baf69a56ff7804f9873caafe5d84b65272d5b4819049e5735957f6a4159006c0cf43863ef68db8985b2a69dda2766a0f005cb67a9194bb884e3e
- TLSH T13B41BBF793B4967E8A1192F4EB15AF1FCE690524031C3CA289D4AE1B57F2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 20bdedc40901f074ff1eddef2220ed4cd9e11e4bae5bef325d74aea0006ef83d
- MD5 a6192933c020c5c06331dbf6952d12a2
- SHA1 1faedaaa6f9d8bc073ae8b845b07a9c0918fab00
- SHA512 d792fc29d0c2c90e899769c11c33bc3cc9b17008b06b8bd908c086583f3e532846ee207a4bad47c50d5ace78010f68eeabd0a5421e5230402b3d57136acb351c
- SSDEEP 192:pR84pCyOozv75pAPRp2uk98Hsb+WNn5CPrwkIE2KTaAvVyIsnAUge:pRVphLVUXEuwAPrJIE2+aee
- TLSH T18C42B72EFE14697BADCBC229FA267767D3F5102125942E84E7FC852C19E75CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 909c1561e27f656bf527543f06947d9fbc17583a197d9a66f88f8dc4126e8d25
- MD5 1c3ce3f07b51179c882907afbdbd0be6
- SHA1 27c59c109083cda64a689db7db614ed85fcbdcec
- SHA512 ee9dff009cb6e19268c12f3440013d23492ef58c7b7a82ae534528f40c31f33d789f09fb347861d6ceeb360ac2a90e83a002f8d7de751fb30a0826f4823db5cd
- SSDEEP 192:pR84p/yOozv75p20PRpfPuk98Hsb+WNn5CPr1kIE2KTaAKVyIsnAUgE:pRVpmLV5XXuwAPrqIE2+aTE
- TLSH T16252A61FF914697BADCBC229F9267B67D3F5202125942E84E7FC862C19E79CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
- MD5 64d379491386bdf9d2b82bfed49740e5
- SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
- SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
- SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
- TLSH T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d0db344e1c11503b649beff6599ea2d1ba3a2478f0acb4129c97199e43c3218c
- MD5 bca6e9cbcee239583a600dc5fbaeb7a5
- SHA1 b8768df0d55c490dbdfab4db97aa80902456630f
- SHA512 2b17e305870bb6fda56e0aadd79576d3fbfb130702b1f7b76fa9e963f657a809c5eb02c4227d2839e34e546eed73ac93b078fc11d6edc75b59dfea2c6dcb04ff
- TLSH T1EEB0124280025101C04203B43192148871185F20D60A170643F07F67C82D573C215050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58edc6.TMP
- Size 120B
- SHA256 52d7e8dfa483eca93c5b7751b3036edbe5b8dbb49e3ccfc8ea715aaf0b961f87
- MD5 0b7a027ce833d29e887d2130f659d08c
- SHA1 05209cc42d86ca5a626ca21939ab86b403cc3c25
- SHA512 0c67c338be2c12b82fd3366e3c167507df92997d67cab6feed3efcf527071b36ba950b9bcdfb489b3f52cca3ea1edda1d64311ae2da33eb6564d5ab6bc97e9e3
- TLSH T186B01272C0839561C00102701E4185DC3018FF35C702030772F40B33E83D2724218140
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 ffb36ddb7a62ccd45700b1575d1deedd57cc8ecef59d25775db7e59706923b28
- MD5 34b8d101a3144fa3e4f8b4e3ff08963e
- SHA1 d32adae3600cb54ba3e13ceaa9909b6635776800
- SHA512 53eba73f465e41faf44d6b5199ebf911f31a23981c8f1943a23624474d389c873c44831b1a1b4c26aa8f91b314fb3fcd0735d6a9c4b684137f58b0a348db9594
- SSDEEP 3072:CkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:CHm7Rkm1tYpBeh2BAoF
- TLSH T166C312379D74A8775DB5BB5EB04E0E1F1DF149A7CD20ED91C8D85A0823E9BCC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2870d0fc4e7c691d05e3c3dffdbae57f90858f8a19ba80584fca3048def1b2fd
- MD5 43fa33d418b474ad2fb9040ddfa4b36c
- SHA1 ba1e0145c13a763094ac037c81dce66cdc0a0896
- SHA512 de1d26516db8810f8013817f6d8706fd6a85ad59d19f8a9742c147f18326a2f489f5917a4b54d6ba0efabf87d692156bd459b3ddd42801c4dc64fa5b5ee98cc8
- SSDEEP 3072:CkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:CHm7Rkm1tYpBeh2BAoF
- TLSH T13DC3123B9D75A8764DB9BB5EB04E0E1F1DF149A7CD20ED91C8D85A0423E9BCC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7bd00b78d864213df7a3b26525bd36c2ba02b2667a28e7e27a49a119890dc23c
- MD5 ae4b6b06ce5494aa44e4117e3edb36c7
- SHA1 01964ea926f299de757014e02639ed807d96900d
- SHA512 76421edf67cdc99690500209af3f7ee518463c0c76c87f078210503d3dd66cbc06104a87bc93f47dac68c836218f4ac68fcb16184c5e0dfbaf247526aec512cc
- SSDEEP 3072:FpGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:FIm7Rkm1tYpBeh2BAoF
- TLSH T19AC312279D75E87659B9BB1EB04E0F1F1EF149A3C920DE92C8D85B0433EABCC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 2be7e99a7bec4b9f1adeba39642276b90d2a5a2f56a86913e05ac1a78b0544dc
- MD5 8e9df6835b81be5540f7fedc3cd5dce3
- SHA1 c9f33679b50ff7cde9cda8db86e1ecf7fd55c059
- SHA512 ded872a489181e65d96e2dfe3166cc90c06451d3e5f8cc33e3914eb8fb6404c75cdc1dda935cda0109135d0eec82f6bcc41fe4f5783565c84894bcc4b3d9f676
- SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Rm7Rkm1tYpBeh2BAoF
- TLSH T1F7C3123B5D71E97759B8BB4EB08E0B1E1EF14AA6C930DE92C8D85A0477F97CC0A04934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 725faded0131fd655f17f60d733b2dca1378bbe4921e92b29a1bd4c9b6fb13b2
- MD5 64c012f71c21f95faaf047f99f981cb2
- SHA1 6f0bdde5e7580a2e2198bb5e6835875144dcf074
- SHA512 cbe9e546d3a286b7bf8974ecd83a779f9e36bf00e91960499d4f0d42b441bbf526c19dbeb61e030c5cc3fb836d38ba3cfbf0132d2afc2da9d62fbc276c8eb231
- SSDEEP 3072:gpGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:gIm7Rkm1tYpBeh2BAoF
- TLSH T19AC312279D75E87659B9BB1EB04E0F1F1EF149A3C920DE92C8D85B0423EABCC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH