Overview
overview
7Static
static
3Xeno-v1.3.60.exe
windows10-2004-x64
7Xeno-v1.3.60.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
3resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 23:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.60.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.60.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260808-3fbdrazxhw
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4744 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307055583307319" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 2884 chrome.exe 2884 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe Token: SeShutdownPrivilege 4116 chrome.exe Token: SeCreatePagefilePrivilege 4116 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe 4116 chrome.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4116 wrote to memory of 4308 4116 chrome.exe 82 PID 4116 wrote to memory of 4744 4116 chrome.exe 83 PID 4116 wrote to memory of 1108 4116 chrome.exe 84 PID 4116 wrote to memory of 1108 4116 chrome.exe 84 PID 4116 wrote to memory of 2336 4116 chrome.exe 86 PID 4116 wrote to memory of 2336 4116 chrome.exe 86 PID 4116 wrote to memory of 556 4116 chrome.exe 87 PID 4116 wrote to memory of 3368 4116 chrome.exe 88 PID 4116 wrote to memory of 556 4116 chrome.exe 87 PID 4116 wrote to memory of 3368 4116 chrome.exe 88 PID 4116 wrote to memory of 3868 4116 chrome.exe 90 PID 4116 wrote to memory of 2728 4116 chrome.exe 104 PID 4116 wrote to memory of 2576 4116 chrome.exe 105 PID 4116 wrote to memory of 540 4116 chrome.exe 106 PID 4116 wrote to memory of 2884 4116 chrome.exe 110
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff97077c728,0x7ff97077c734,0x7ff97077c7402⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,17842730721319224169,262316971787144989,524288 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:32⤵
- System Time Discovery
PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,1263029330521143099,9216952172823830116,262144 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,6760406961457122147,16264984485615909448,524288 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,12512044384734970058,3991540510018385977,2097152 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,11724592541079935764,5557548140596170890,2097152 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,9565737502731943673,1579155637727946019,524288 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,69655736037452833,8207668798007112051,524288 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,2533874086540710873,8859367327335846570,524288 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:82⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,1210669223625790581,1029494907455766502,524288 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5504,i,17046658941611167250,930927152169220749,262144 --field-trial-handle=2120,i,14381419305185741498,5574174085751621875,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 86ad92c6e00c0709c32446de6f4f6409767d477fc1eee2601f52d51d72dcc268
- MD5 0d236511ef2a72101869b5dc3d70cab9
- SHA1 38ee9e3c6a8a138479cf0297471e5d16a05b56b5
- SHA512 bc1a50f19b909d59333c7497e5571b3585db3d5b100dcfa80b2bd37389a26051183850b54d088add907efc0a29572f242fe22871a94e91c5aa4089b8ec03425a
- TLSH T106E02BB9C961EC2B28FF1758A0918746F71413AB2650495B7A3D850C8FF1A3A564581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 7cfc179e4034857cef59afc1d12ed2cca6427f92d47a8f72520d39ce42572b91
- MD5 724ab9e1f57746189c70ac727052abb9
- SHA1 5a9ad379140f5c17201cbb895c05838faf1cad2a
- SHA512 f54515b98736a084ee68d54ea78cef5addea961416424548426649af1f7f1e7a8b1269b1669d6c555fcc9672537dc85f5d5b87289358cbd3d37921e24380d2d2
- TLSH T1B8317CF793B4997E8A1152E4EB15AF1FCE6A0524031C3C6689D46E2B83E2972D10479F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 f71cf1bbf77f0055476546db90a988144f2c708ea478add51dd39599f50ce1f4
- MD5 f7a7fbcf14b97ca3df15d6f47ae0cf2f
- SHA1 d8f71b84110667431527ad107cfc988a57d4d780
- SHA512 67b0780ddc236048c53f0d272e25d240590b59c11134a4ad44b9edb8e0e232e5d5d576cfa637556c35deb075930d212050338108df2abaf5dd2fdac63017d30b
- SSDEEP 192:6RDUHsdeGv72vAPRp2Zp9THsb+WNnifqPFcSekhj8oyag7cuVyIsnAUge:6RDUMAyC6XMFwPPfj8oyagXe
- TLSH T18B42A62EAA20293B5CDBD229FA617767D7F6103275D42E84E7FC892C14D75CD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 be7e983d9e999ec9e9032375128f2bcc7bdb2b0910d34aa4241c0a0507c6bead
- MD5 3c294872cea95b42abb4904768dba8d6
- SHA1 b8ecb36a50c82338b8511cb484b8ead85b83ba42
- SHA512 6f3a1df06572672851cf862eab2e2e6693ee486d6d31163b50a4dfefd154acb8b4eca8d6a638431317bb9d51f3785b57e70ea491a71b3c12e74821f512f9fbea
- SSDEEP 192:6RDUHsdeGv72vFPRpJZp9THsb+WNnifqPFxSekhj8oyag7cvVyIsnAUgE:6RDUMAyClXFFwPPmj8oyagyE
- TLSH T15742C72EA920293B5CDBD229FA617B67E7F5103235E42E44E7FC892C14E75CD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
- MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
- SHA1 c0965f169b36b690aaf700b8f80359944a908774
- SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
- SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
- TLSH T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 bc5942cb3bd7bb93a725deb09ac7be81faff76e3ded1e108ff6eed16c3ec7d69
- MD5 fe0688e77afcd0afeff43552937f0ee4
- SHA1 79f27a738e954a34b19dd0aab61a50cfbf6e5227
- SHA512 ddd6a8c0c0992a68e9ab37c8e2b320a9814410108f414b944b7b1128befc51179ee615600a16719e202df7a943c703aeb8a75ed8ef6e239132d031571aa07ea2
- SSDEEP 3072:LkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:LHm7Rkm1tYpBeh2BAom
- TLSH T193C3123B5D74A8365DB9BB5EB08E0B1F1EF14AA6C934DE52C8D45B0433EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 1077d166e566f3845e075b31b8a766b25536730673b2ed666cd58cdada00206e
- MD5 3d4ea3598ce316c8a0d1af1d2129b8be
- SHA1 fe4bc9151548e96eff2a70619cfab6a7cc2e2598
- SHA512 b9bb7f9581a54e0d796e29d4a5e0f447fbb345efbff3c5d9ea16051b28dfb1e64eb1dce253ebe6b8f3cdb8b8f67613480622c3e27ae2d84df9980b901d2c8e8a
- SSDEEP 3072:kkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:kHm7Rkm1tYpBeh2BAom
- TLSH T16AC3123B5D74A8365DB9BB5EB08E0B1F1EF14AA6C934DE52C8D85B0433EA7CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 211KB
- SHA256 d7194493e4229984bc924b56bb1fe2f601cecd61bf6510186995ffa8ce9e0913
- MD5 341a9edeac46163c655b68f3ab716f99
- SHA1 28439557757e541823866326bbe655b606328635
- SHA512 4b3ab64ff5961597da2a6dd8fef01b1ec1a43a1e5833b92803260ddb7fb9bdb482c9486f9d63b8a6b4ef62ff51f89f96a780d3e8af16b7f4d55aa5474a579901
- SSDEEP 3072:26/+5e8sFTYHcB1xHJP7Rt/TbYP8fZUPAGm7D5Lk17ox1tIpud63U8BehbCBi9fn:2n4tFUHcBZ/9xOrm7Rkm1tYpBeh2BAom
- TLSH T18224223B4D39E87688E59B5BF04A0A5E6DF158D7CC60DB43D8D22A0433EBAD8564C038
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 2e37ff508f43429f951b2c9b8e3f392587c30f80c13d69d5acb397e7d7debfab
- MD5 38d7a7113955dafb2f819cff7ac0fd82
- SHA1 13391608bd009d98eb1332797b3958abfc60973b
- SHA512 75822b0f34e3d1456873c6097e073b5b8e804c82b9833ec4dd9945ad05e74c0f300061ce5418edad42533b3cc9046c538fc53d87e2bc3116741faa741c2035c4
- SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:3m7Rkm1tYpBeh2BAom
- TLSH T1C6C3123B5E70E9775979B74EB08E0B1F1EF14AA2D930DA52C8D85A0437FA7CC0A05934
- MD5 SHA1 SHA512 SSDEEP TLSH