Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows10-2004-x64
7Xeno-v1.3.55.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
3resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 02:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260712-c3k9cset21
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3280 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282977009251535" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 1780 chrome.exe 1780 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4968 wrote to memory of 5836 4968 chrome.exe 84 PID 4968 wrote to memory of 5280 4968 chrome.exe 85 PID 4968 wrote to memory of 3280 4968 chrome.exe 86 PID 4968 wrote to memory of 5280 4968 chrome.exe 85 PID 4968 wrote to memory of 3928 4968 chrome.exe 88 PID 4968 wrote to memory of 3928 4968 chrome.exe 88 PID 4968 wrote to memory of 6012 4968 chrome.exe 89 PID 4968 wrote to memory of 4056 4968 chrome.exe 90 PID 4968 wrote to memory of 6012 4968 chrome.exe 89 PID 4968 wrote to memory of 4056 4968 chrome.exe 90 PID 4968 wrote to memory of 1712 4968 chrome.exe 91 PID 4968 wrote to memory of 1712 4968 chrome.exe 91 PID 4968 wrote to memory of 4896 4968 chrome.exe 93 PID 4968 wrote to memory of 3456 4968 chrome.exe 108 PID 4968 wrote to memory of 5832 4968 chrome.exe 109 PID 4968 wrote to memory of 3036 4968 chrome.exe 110 PID 4968 wrote to memory of 1780 4968 chrome.exe 122
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc829ac728,0x7ffc829ac734,0x7ffc829ac7402⤵PID:5836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,11082550676585977247,271262081017235456,262144 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:22⤵PID:5280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,15394606399026341655,5543187304760437821,524288 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:32⤵
- System Time Discovery
PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,1009766193597585133,6854442545144132836,524288 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:82⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,6501312981762008354,16998018509315527884,2097152 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:6012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,17933038011457134169,56797784420360421,2097152 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,16258960313863919252,8467536093537717809,2097152 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:22⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,607037189896812290,10968224815309612216,524288 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,14847782733483353940,18165425886055614974,524288 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:82⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,17998018700179034232,602066877680112300,524288 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:82⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,13447946312253848152,1536431855846429024,524288 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:82⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5816,i,18426485233314087151,10932406858491132390,262144 --field-trial-handle=1956,i,15240807441264365674,17897775380797991448,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=732 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e940398a94019f79149bb333c6d8a01265490a61e54063b6bbfe99c9992dba86
- MD5 9559cc41f0456ab497e2db2f10fd14b5
- SHA1 764912249b963a755c374f14508eaaf13ecad9a5
- SHA512 6013dc6457140b1841765144fcc5850bfd72144b11dfb91ad41d35dd015cb97a190792b351ba76003fd78a334f05848e39d9f3f2d080e47fcb352ef30a9d6a5f
- TLSH T127E022AAC9B2DC3B2CFD0B5DA0544786EA5423573B40958B3B3C89088FB423B428AC5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c04e241e1212c47ab306c11bb44126c2ac2f1c38c30036d6e128a67b48a3bd43
- MD5 d60c4a3348e32d80fa6e55c0b58d61be
- SHA1 7d021896d1f30ac708cdc053e266dc990053b07f
- SHA512 6deeac3350b393a871bbcb660916b50eb97b32c94ee44d4f5da2bcec83b520cedf70ee8db7bcba9674fce98fd29dc0435e5f3100b0995bee170912dc9282ad50
- TLSH T16A41ADF783F4857E8A1196F4EA156E1FCE6D0524432C7CA689D4AE2B43F2872D10078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a1f6342b57f1071623bfe2b55507e2c026ed3b299cc5f75e8c001faed227be37
- MD5 9d4a06151bbc9896da85f23bc2662184
- SHA1 c46cdce16dd893b63f681d65a0ff0cb1b8244b42
- SHA512 22b22776df76545804d6a94f61c648888fd85b3bd1f66d319c6afdd32a1d552f99597c0298317c3e6419c254002fa5d918bbfdebf65aab46f62005be8efe1d28
- SSDEEP 192:5RnKwiU+Wo1Ln9iv71hpAPRp2OJ92Hsb+WNnmTPluvacoEgVyIsnAUgE:5RnKwiU5o7uBhUXxQwYP4atE
- TLSH T11842C62FA910697BACDBD62AF9127B53E7F4102521E12E80E7FCCA1C15E75CC222751B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c0611b7ed8ab66297f3ec0c2a62f7000e0ecb28cb0d121ec5de4f762f04ae33f
- MD5 ead5dd793fb34621708f2d3cb01c222a
- SHA1 4e3511ecdec634652fd92b9b0f3d80765631ebdf
- SHA512 c252a8d33d7d2c371271af37c317edf16d16dc01748a7893f454f5cb8ac93493ca2023142418344e85e82cd6a958e310c6dd5e6601a121d2699a33542fea7429
- SSDEEP 192:5RnKwiU/RQTLn9iv71hpAPRp2OJ92Hsb+WNnmTPwuvacoEvVyIsnAUge:5RnKwiU5QduBhUXxQwYPNa8e
- TLSH T1D742B42FA910697B6CDBD22AF9127753E7F5102521E12E84E7FCCA1C15E7ACC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 14beef0712068324b250f96304ab7714688304d4a678eaf214436c4271c97bd1
- MD5 d83c2a860f56cef49ba6de71804fa7bb
- SHA1 8cd7e41c02119a2c033556420d611b63865430d2
- SHA512 7e59154b595e7acaf6a2f425628299a84f3402d4f5b7d5825d980dded56d93ef669a78796f219244587974a1f55ae15d44e3bf6beba19416d40d41a7257aabb6
- SSDEEP 192:5RnKwiU1Wo1Ln9iv71hpAPRp2OJ92Hsb+WNnmTPluvacoEgVyIsnAUgE:5RnKwiUoo7uBhUXxQwYP4atE
- TLSH T1D342C62FA910697BACDBD62AF9127B53E7F4102521E11E80E7FCCA1C15E75CC222751B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 0de142cdb2800b5fea1c2db044833280f2e62806076164cd336d3394555ec0f6
- MD5 37d69ff605d6fb185e16f89a9708d96f
- SHA1 07d079cd150d9a6900af9b6f34350aba1d35fe70
- SHA512 498326bce13d97159d23914eb143b1a6a4f5ed6b454372d431c578f4489b2c7d00415c02b5168f97706bce12fc14b6a453e90fd9239ab64ecc23a4e7d202d9f8
- TLSH T1EEB01250C4C25501C41202F81183548871149F10AA0A970143E07932AC251508034160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589517.TMP
- Size 96B
- SHA256 cbb7b92a82ec4dbade51170e8c95edd09d7ee6f92c874193671043e5e05c54e7
- MD5 21e746b4ce0adf8c75e6dca17f2c1efd
- SHA1 e70fd891158acfa33c4a3ab0c1c31f941bae5d9f
- SHA512 3cd42fc01e86b9c0d172aac8602d180cc58746d804c8ad6df9649ea73b3f3ebfb975e76379f0561d4a064b0ae097ba110a2e6fb2f2f24b2d874e63b59b026386
- TLSH T1EEB02282C2023203C88303B02A82A0CC3020CF30E203022283F00A2ACC202200020020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 74152d648cd00895c8c76b50989e2a481d31065c204102bd7db8306240d52b4a
- MD5 602b20db548b71db41c5a895af929234
- SHA1 db032b07f25bcdc30eb13e1e0334b0841d29bc65
- SHA512 a705910f7445036c786dc4ddc68fe2c9fee5b8b0fe55c31855cf534acff01fb8c558e7757e091fd2eb4699d6e49faeac1a7b59f0319023f6c46f6fc1b7c38720
- SSDEEP 3072:LFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:LMm7Rkm1tYpBeh2BAo3
- TLSH T14AC3123B5DB5AD375DB9BB1EB04E0B1F1DF149A6C920DE92C8D85B0823EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 707347fe94b31b4eb610a94b69e4fef2d3c7cc198b04247875762e23011c26ec
- MD5 e07b5444793d7b0a8fcd523d88fb0e4e
- SHA1 c697b162afa65ef0f756166263f5f0793ebfd527
- SHA512 1c4f003dacde4ecd3b709a43d91e37643df7e28912fd2edc2533ab860f0fea18184b9c46811f1d72fa261e999be2ae41113b01a8204e11a9b98fed5c34bd95ee
- SSDEEP 3072:dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:0m7Rkm1tYpBeh2BAo3
- TLSH T16BC312275E71E9375D79AB0EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7c937ec1a874e87a1d4d069843d30c4c0886d540801329cbe2715b4c126f38cf
- MD5 4026a9593e27f07e0fe5b54769635347
- SHA1 2369a5fb623f0452cd93594eb943118304fc1294
- SHA512 5b637659ff6ef1a3b84bf35d1fc228c7ca67a3ccf2048ae7dc245905a7481ea1ddee25a87d2bd7609f8d8be06c3ced8c7229149f809ad6ee834dbefa7d5584a8
- SSDEEP 3072:wFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:wMm7Rkm1tYpBeh2BAo3
- TLSH T177C3123B5DB5A9375DB9BB1EB04E0B1F1DF149A6C920DE92C8D85B0823EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4f3e8cc5b621c7fb9981cb4c3082019a78b6a4d8e5931775ad650c57ffe9aa59
- MD5 085eabd7431a6158b6045e2c81de2100
- SHA1 565870c96ddc01d02fd33bffa6648e02478c64f6
- SHA512 c17100e4353cf1265948c9e0ec510284ce92457b20f814dbf6c68cb809e162a5a604dc71ff5cbb91d0444dc0f7bcd6c4a9c451ebe84b96a6222ce80424da284f
- SSDEEP 3072:LyGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:LFm7Rkm1tYpBeh2BAo3
- TLSH T189C3123B5D75A8375DB9BB0EB08E0B1F1DF24AA6C920DE52C8D85B0423E97CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH