Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows11-21h2-x64
3resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows11-21h2-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...rt.dll
windows11-21h2-x64
1resources/...se.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...b1.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
900s - max time network
895s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/07/2026, 14:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
900 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral5
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral20
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
resources/public/libssl-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
resources/public/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
resources/public/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
resources/public/msvcrt.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
resources/public/ucrtbase.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
resources/public/vcruntime140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
resources/public/vcruntime140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
resources/public/zlib1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260710-rsagfabs4p
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4024 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281676636562065" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 4008 chrome.exe 4008 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe Token: SeShutdownPrivilege 2532 chrome.exe Token: SeCreatePagefilePrivilege 2532 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe 2532 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1284 2532 chrome.exe 80 PID 2532 wrote to memory of 1732 2532 chrome.exe 81 PID 2532 wrote to memory of 4024 2532 chrome.exe 82 PID 2532 wrote to memory of 1732 2532 chrome.exe 81 PID 2532 wrote to memory of 1528 2532 chrome.exe 85 PID 2532 wrote to memory of 3844 2532 chrome.exe 86 PID 2532 wrote to memory of 1528 2532 chrome.exe 85 PID 2532 wrote to memory of 3844 2532 chrome.exe 86 PID 2532 wrote to memory of 1868 2532 chrome.exe 84 PID 2532 wrote to memory of 1868 2532 chrome.exe 84 PID 2532 wrote to memory of 2528 2532 chrome.exe 87 PID 2532 wrote to memory of 2528 2532 chrome.exe 87 PID 2532 wrote to memory of 4184 2532 chrome.exe 89 PID 2532 wrote to memory of 4644 2532 chrome.exe 91 PID 2532 wrote to memory of 1192 2532 chrome.exe 92 PID 2532 wrote to memory of 4972 2532 chrome.exe 93 PID 2532 wrote to memory of 4008 2532 chrome.exe 94 PID 2532 wrote to memory of 2364 2532 chrome.exe 95 PID 2532 wrote to memory of 2364 2532 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fd89c728,0x7ff9fd89c734,0x7ff9fd89c7402⤵PID:1284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,17690572543931720990,6835694172975025532,262144 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1824 /prefetch:22⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,5798151961284335991,10459865219923795107,524288 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:112⤵
- System Time Discovery
PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,9211134113342980441,9436719975504838521,524288 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2664 /prefetch:132⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,13876629878095571626,1773805685207462573,2097152 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,17619286641988028300,10166637658823799266,2097152 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,7241497574642202462,13920228530263285783,2097152 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:92⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,15806136147508361796,16940136554154966765,524288 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:142⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,9261297988936504399,9230313635662793180,524288 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:142⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,14042132017203722748,11010970005997012374,524288 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:142⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,17485522890879622679,13490528740226098154,524288 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:142⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5604,i,2745038607000944583,3638866159435659802,262144 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,17315634318201822493,14515794900846291300,524288 --field-trial-handle=1980,i,15052498136271768406,7964997949188478723,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:142⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3440
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1048
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\339c26e1-dd3a-4565-ad12-4498fd482a9e.tmp
- Size 116KB
- SHA256 b2f8d0c7219bc854d718532a0ebea34d4696028e8c53da382202ac4d8ca6d6e4
- MD5 34464f68bf66d0734017f8a5077160a9
- SHA1 a0841ae5918cbb9a3f5147158892d2ea38d1b1cd
- SHA512 f489c80301fb6723d25cfa31cf3bf85e3de9a73e23f34d64268205c8aaba153f2718412fd41de659b71b1c0f64f782f8ef60c35aa0a73441bdd1d2537aad525a
- SSDEEP 3072:kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Hm7Rkm1tYpBeh2BAoe
- TLSH T109C312375D74A937A9B5BB1EB08E0B1F1EF149A7C920DE92C8D85B0423EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 228c6dc13bca31d407ea5849a912bb8c51d4af5ff14a71d874ab227cc9e3c3fe
- MD5 26e97cea2cbb73da7b5c17eb816c432e
- SHA1 03f9b2e955b49ebdea4abbddd7538694d5e78360
- SHA512 56928376037b3aa42bd5112536b1de74334fc71caceac6f60e6da3baf895341ccb1d570a6349041fb3ca26220319aa1e192ed8e16f13e55b45beb6e7203121a7
- TLSH T1C4E02BAACA21AC2B2CFC472868544B8BEB1003662750594F3F3D420D8FB12368585C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 3467d11e326e41de5c92ff222a9db70edd9a9bafa06a128754bf161e33f336f0
- MD5 3490d3042d3adae8fd69c2a67ed4970f
- SHA1 5c23207e416db4133d0ea78183781cc0f06dabf1
- SHA512 458ae9ac2edf56e097764604786579c1da5d80ca6d0d17e06983b0260d481f8ff9a8956e45f93cc5dd74c06a17fbda5121fadd6659650f45b0fb765546db27d6
- TLSH T1DC419BF793B4897E8A1192E4EB156E2FCE690524031C3CB6C8D4AE1B53F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 37ef24a4a9e0ec0dc4e41eeb41a04de0d0e8f3ad5adc0949268de69c84cfb76e
- MD5 32ad64c14dd7c01a6e0570a414b52e36
- SHA1 f5f610732df7820aedb8339f4bb1acf344d06ee9
- SHA512 4d787386ead1d640e1f5def932964b1bb7925e7059f9f7b2e8fea847892afe4fd7175d87cb02d7ce98f975d68cb34472aa6692a2932304ea51f49954ad6e2d96
- TLSH T1C5417CF793E4857D8A1196E4AB156E2FCE690524032C3CA688D46E1B53F2872D14078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 639539602a79baca944eb06fa0be764190a33be68d74a055095f4af69b4cdeda
- MD5 b9895e765992e64c4cf0746a8a868730
- SHA1 3426cb40fe0551b27ad6b2a94e32785001ae60b8
- SHA512 9fd2ba5b60945dc7c3a0260d6e142c62ccf74efef948155d44254f602c38af3db56b582f46b30475801d9b928b7df149b7fb6fde22991119b7d67ebccad17a37
- TLSH T18E419EF783F4857D8A1196F4EB156E2FCE690524032C3CA688D46E1B53F3972D14078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 aeb1a14163e03a339587910beb13895d88fb3e0b4ecebdee416d31a2ff558342
- MD5 f57ad9c462919d7f6012eae1a04ebc16
- SHA1 cd7168155e69245277338d205428add698590f4f
- SHA512 daf9ab697188dfd2a617b388eae0f451cc5fa58e88266e0b36bad234b825db66a07437798d4438e36ed198ef340729a08da6f88c87e7e8d94983f766808faba4
- TLSH T108418AF793B4897E8A1192E4EA156E1FCE6D0524031C3CB689E4AE1B43F2872D10078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 f42fb766677122a57926ae26094d88932c5dd985774b6db2cf6d9f1b94191c0f
- MD5 8fd683810dad843dcde0cae31d640206
- SHA1 ccbb2bac2e6cfd634fea1315e981e5048002b820
- SHA512 961d8d6db8aaaffda1378eb7a8288255cf1ec200d19831ad8853cc695333271b7e72aacad7a65da93d3b6d2d67274deadaa0851c41301861dd355971ef9ff6b3
- TLSH T18AF05967E7BDB45310BD05EF0E207C0928B9B83106807CE6CEBA826CE0D24F31B06863
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 d039bdde0f830fd2bc385a3b29fbaf43cf08cf75ff34dc6def67d9587dc50dcf
- MD5 506d5b0524d9d45468f90d0195e52462
- SHA1 1ec7f3e3d5fee81cb73b1f769b9716ae4084cd0d
- SHA512 c4b2bde3aa2cbc2c1b9e7a36f290cc5a5dcbab924bd986b8400dd6db0abf41c7bbdd393e98f1f3060ee9d59849bb732169b2c427a6c359e62e4a759b6897f9db
- SSDEEP 192:NR59R1pTUDCYv7sBpAPRp2t69NHsb+WNnogPGPeg/awqwVyIsnAUge:NRrH/E8UXTrwZPGPxage
- TLSH T1D642D62FB910693BACDBD229F922B753E7F5202125D42E84E7FC8A2C15E79CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 c40482e1aaf0f22bd3400b7c1f04384d245956b34b435f275b59ca120e238c23
- MD5 827f8f322956a9d58db9f903519200f8
- SHA1 48a8cae99fb626c3c23cf9e7e7e84c494dadf76a
- SHA512 d0d07f253d5c8470bc40eb4f67332a0f16d09dd97441a83e103f640951e84d8c104625294d065beacf1c8e6448a20d260647724b5c59d8bb306704185b3c607f
- SSDEEP 192:NR59R1TTUDCYv7sBp8PRpWt69NHsb+WNnogPGUeg/awqWVyIsnAUgE:NRrHRE8QXzrwZPGUxaCE
- TLSH T18752A41FB910697BBCDAD269F922B753E7F5202125D02E88E7FC8A1C15E7ACD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
- MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
- SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
- SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
- SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
- TLSH T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 e3dfc11e825e068888da7c53ee39e69863cc1c66c6a6407804d62cd8b46b60db
- MD5 c324296ca0378fb5e679b8fd86e41c43
- SHA1 d460d7b21584212c8e951e910912245a7c0b9648
- SHA512 e263ca4745308e791b0b5a874ca2bbc1cb2f210345e5aa8c359770596634b359277398c2d6c7e411228bad47cc025f682d9abf09edd4c483933e96095721d1e6
- TLSH T180B0124084019101D01206F41242288CB164AF15960E2702A3E06AA3C83A1518014153
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5871df.TMP
- Size 96B
- SHA256 57d236f2ba29a44c09fc3ef106185e46188d9dce132fb20cba421c665de0279e
- MD5 666a21d145f891a71dcfee921d1271cd
- SHA1 5aabc95d6355db8c9341377e15de012aaec31a0e
- SHA512 1f8aad4b3e79e01d9025fde155dceb9afe1dfa33474b00e1c7fb7be4a4749573b3a6bceb38335e60d0e0e9cf6ee4da87852de4f5959ce4c0b9b71f68fa63ca93
- TLSH T1ADB00255D2026222D09247B02995D5DC7164DF26C6032256A3E11A67DD39A60462A661
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 15e113b5e99b62247448e00c5e68da0daf02b0efa70860ff9fef60098b9f7d4d
- MD5 939921191a4f8a5429f1a560722ea56e
- SHA1 81bd6b6e4d743989c12d3258e54e2cf51f8a0cc7
- SHA512 852072220e0329e7b31993647f11e564b38119acbb1fbc0d1e2116f1c8675a0b4ca712aa092959dafbd83f9108a0ba7e586dd6707658ff799b7f4f96070474c1
- SSDEEP 3072:XUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:XXm7Rkm1tYpBeh2BAoe
- TLSH T179C312379D78A8379DB5BB0EB08E1E1F1DF149A7D920EE95CCD85B0423E9ACC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 544bfd2f9bc32b8f1465edf1c466a6b7d42bbda5a655a6a9c674ba2f1a60c5a5
- MD5 69cdf305e9af0977bcef1d0416811ecd
- SHA1 c03baf108b8cda9f162c8a3459bc7e831832adf4
- SHA512 4e2f369598ddeefa0f60d6a7adee68f9427cc2fcb066e488f6684f9394fc19834044f11c47d3897775e41972b28d0f830345653a41a14a4b11af4dcde0ca891b
- SSDEEP 3072:7UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:7Xm7Rkm1tYpBeh2BAoe
- TLSH T1AFC312379D78A8379DB5BB0EB04E1E1F1DF149A7D920EE95CCD85A0423E9BCC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 80b09c4cde579c3efa5d7ed3885abb2263328a964cc60b5e9fe4b597da77ed58
- MD5 78ae0b3f0043c846e7bd249932f3f08e
- SHA1 781745cfa262d328b8bbb7f579bf1178aba390f7
- SHA512 84ae7ff7c8823d0cddb19edd43bedbb2150f226d57a05391d964905a8bc4b3593cc5249e8fb36190cc4d8d2c5733c178fe99b3f48d467bb18b2efe17ca4c5657
- SSDEEP 3072:vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:+m7Rkm1tYpBeh2BAoe
- TLSH T16BC312375D74A937A9B5BB1EB04E1B1F1EF149A7C920DE92C8D85B0433EABCC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 1343f54b95d14bc5406b70e7b0c7a755ad6c4ffd8dfd46c6bdaa69dcaa26b35c
- MD5 1999a80e234deab84cb9525d24468308
- SHA1 35989da59707245a4620090bfaa2c9c2d6a02ca2
- SHA512 55ae7cbcd94704a9017b5bfce93fda0c0c77f6cba57f1f72e6c70e96afbb9915c443c4b4d5745ebdfa8b0b00690b3d878b1ad48c49a8c96624186f5bfeef6abd
- SSDEEP 3072:1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:cm7Rkm1tYpBeh2BAoe
- TLSH T1B5C312275E75A97799B5BB0EB08E0B1F1EF14EA6C920DE82C8D85B0427E97CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH