Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
3resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 02:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260712-c3k9cset21
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1724 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282976879972920" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 4412 chrome.exe 4412 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe Token: SeShutdownPrivilege 2136 chrome.exe Token: SeCreatePagefilePrivilege 2136 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe 2136 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4492 2136 chrome.exe 81 PID 2136 wrote to memory of 2540 2136 chrome.exe 82 PID 2136 wrote to memory of 2540 2136 chrome.exe 82 PID 2136 wrote to memory of 1724 2136 chrome.exe 83 PID 2136 wrote to memory of 724 2136 chrome.exe 84 PID 2136 wrote to memory of 724 2136 chrome.exe 84 PID 2136 wrote to memory of 824 2136 chrome.exe 86 PID 2136 wrote to memory of 3972 2136 chrome.exe 87 PID 2136 wrote to memory of 824 2136 chrome.exe 86 PID 2136 wrote to memory of 3972 2136 chrome.exe 87 PID 2136 wrote to memory of 452 2136 chrome.exe 88 PID 2136 wrote to memory of 452 2136 chrome.exe 88 PID 2136 wrote to memory of 4360 2136 chrome.exe 89 PID 2136 wrote to memory of 2348 2136 chrome.exe 103 PID 2136 wrote to memory of 3488 2136 chrome.exe 104 PID 2136 wrote to memory of 964 2136 chrome.exe 105 PID 2136 wrote to memory of 4412 2136 chrome.exe 117
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef5b5c728,0x7ffef5b5c734,0x7ffef5b5c7402⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,8395384146615135314,3189047075442973678,262144 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:22⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,10598829440309236930,17676848358729396693,524288 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- System Time Discovery
PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,16522714107024256364,15319960879531694968,524288 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:82⤵PID:724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,9091334562370856499,3658691317645668395,2097152 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,3937713818604927994,11573236982624601647,2097152 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,12251132798304640712,9937952404263385219,2097152 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:22⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,11625552287264738300,7260315899447598262,524288 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:82⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,18325745563337814069,13837721113156575596,524288 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,1924988063268699738,10060178910879492638,524288 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:82⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,10670989936870805340,14760857724188969634,524288 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4592,i,1674981509298978658,12203746380004307142,262144 --field-trial-handle=1932,i,6672350542676008498,13094966941184603054,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 9bc47904e0e32d0324c71fc57b4cdc4033960725d20c1b452014552561d08348
- MD5 9bfea41a5973ca935eb7d597792af092
- SHA1 d15ac2a72a7e8d167e10d8c6384c9eca39382cd4
- SHA512 8e6146fe582879f26b781a58b14c8506d1fbf3cd234c2c5638d85c471d198ecb96fdbbe3ea2e0c2faff6783507c57ab9315a8ceb554e1d27aaec1c35e9ad43be
- TLSH T150E02BAAC861DC6B14F90B69B4205786D759135B2A41894B7B3D810C8FB16364986C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 ecf6b07572422c9623c693abf7701304df185b4e33d0742082f18a95c688d2cb
- MD5 f534fca9243fd60030ce9f6405deda3c
- SHA1 7fa3b9bff9d0d1e031888df03b5d4f45c38949c2
- SHA512 c145bf18bce01c3b7b0dae6ef9dbc12c8bb80738bd8df524e68dd8d1e2b5cdde1a206615818fdce3f45e65bb4ef16bbdcda85267e1074738ec813641d2998511
- TLSH T1FC419DF793B4957E8A1192E4EB156F1FCE6D0624031C7CA688D46E2B43F2972D10179F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6a1e6882a3b31d983c6b42e671fcb9e7f3fb37a0b9420ebb78e9fbc4b9d92e18
- MD5 60a9e01cb84a2ae47ea7f0c726f2d1ca
- SHA1 6ebfb0dfd5490a9b091344e5a5fadf4ea30f9fa9
- SHA512 fc0cde915783bcb5f5da119d88e378374349d2ea0ea4b4880916a2e30db8802eb639a973f9e833b36b28dcbd914f4986c81849b5f70c221fee83e7a0eb825aa6
- SSDEEP 192:IRsJ+cwaQZhv70pAPRp2df19+Hsb+WNnUIuP6IwLaAHnVyIsnAUge:IRsJMxgUXU8w2P6Xace
- TLSH T17F42C72EAA10693FADDFC229FD617B53D7F6102125952E84E7FC8A1C09E75CC212742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
- MD5 3db4d2ed90c53237037f403d9b6c10cf
- SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
- SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
- SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
- TLSH T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d1c44595dd37972b3c9ec3b3c4b0766224f88e18c5bbc9fd3c6320dc1a7d8e6f
- MD5 ce7f4b6eadcfc23be304bacef4e83991
- SHA1 104cdc70ad1847a5f7f2cc8e95cba0b6558bcfa6
- SHA512 f6fecc5d5dc3f762470954935023d1e835ab419499364c4e0147c4addc15259f7e52576cf91fe4f5b36763596415c408a27d0c6f2ae0672d95747412325b2f9e
- TLSH T152B01241C8019202C40603F4114218CC71189F29A60E270183F0692288263518025191
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e375.TMP
- Size 96B
- SHA256 b6f5da85b3738fbc085220823610e9db8c95f2057a40ef45eb512fc08f9702b8
- MD5 31f35f0032026a737c40387dad96246b
- SHA1 97306d1bea4f2ac2487fcb01c290b9a947e10e9b
- SHA512 fdfe7e3ae7e368c9148fb566201d0976636d39ddc02005fb8662e0c00c642afbaa5369cf2101807f877cbbf84130d845446b54144df5c8851a5507400d756d59
- TLSH T198B02280C203A302C00203F028CAA8F83020CF20C203030282F02B3ACCA02200820320
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 76e86fc6c3dd7b8ca48105e1fea310c3fdba9dd2f82a13ed88218c8fc4faeb28
- MD5 34d790ef39a5a724a74dc47fae103c82
- SHA1 4aa71e87f84720992d73c9228ea4e7b021041581
- SHA512 4d36f047fd2248b8447dcba23bce0128e70abc98aff4e831330ab479d29de0b59886f1986bc6018cd9cd987a2d2a6ba6d96dd4ef2e432320d9db4c2c56ce4854
- SSDEEP 1536:mx9X2yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICo:mXXcqfd7NtZL8cHQRZEQ6Sps3
- TLSH T1ACC30237EBC21F379E83CB64B9530FD797B644A99034D301ABAD37EB688359164424AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 cd25dec501e7c56d6df3a957596a35ca18bdd95c79e269a4d47b31f13016dd3c
- MD5 cd721b469b9efd431586c787b1dd459d
- SHA1 e11471f6b02338ccb67272bace958f760ca50239
- SHA512 81a8d5601c31134c5ee8f31c9a48db00828513f5f383cb532783f99ccb58def7d16a117715ad819c3ca89491aa1c34302ebffb3aaca68af585bc6599e48fd631
- SSDEEP 1536:mM9X2yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICo:mEXcqfd7NtZL8cHQRZEQ6Sps3
- TLSH T1E0C30237ABC21F379D83CB64B9130FD797B644A99034D301ABAD37EB688359564424AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 95314c556fb5ea4810bef1324c71dcbae04061f4a71802e125499c7dcd4eaae0
- MD5 6c1ed164b741e3f6b33f43b31b8ec51a
- SHA1 18b89e31122441d42929a3d3871b12f079fec797
- SHA512 700c2fc54c563fe90a8edf515c093525c976ca150cfd7dc9c14e7fb293501571a64f70226e3a07a5fac71cc3383957ee9f0580364ac3aa1889ec9acee5e45f5a
- SSDEEP 1536:b1LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Xqfd7NtZL8cHQRZEQ6Sps3
- TLSH T154C30237ABC21F379D92CF64B9130FD6A7B644A99030D301AAAD37EB7C93591684249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7838a1a7c18ce0781a1758d48f716323d08114d347513473082985c0c2f547ea
- MD5 2dec1aefe64fd3bff1c5dbf26ac33f86
- SHA1 fd95662d5f46cd2099bd7ff3afe639e4f2a9159f
- SHA512 7a10495a2592a3e1c8ef20a342e5812171f75d80884c5c988fc806d922f0c50237cf5687ebb0ea7c5e218ff49626c4f73459d674c1988ca565fc47215b51bce7
- SSDEEP 1536:mM9XyyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICo:mEXgqfd7NtZL8cHQRZEQ6Sps3
- TLSH T16CC30237EBC21E375DD2DF64B5130ED753B644A99034D301EEAD37AB6883551A4428AC
- MD5 SHA1 SHA512 SSDEEP TLSH