Overview
overview
7Static
static
3Xeno-v1.3.60.exe
windows10-2004-x64
7Xeno-v1.3.60.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Xeno-v1.3.60.exe
windows10-2004-x64
7Xeno-v1.3.60.exe
windows11-ltsc_2024-x64
6resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
3resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 07:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.60.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.60.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.60.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.60.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260808-jl68tscd68
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2648 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306494258564557" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 6108 chrome.exe 6108 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe Token: SeShutdownPrivilege 5272 chrome.exe Token: SeCreatePagefilePrivilege 5272 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe 5272 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5272 wrote to memory of 5236 5272 chrome.exe 83 PID 5272 wrote to memory of 2648 5272 chrome.exe 84 PID 5272 wrote to memory of 3100 5272 chrome.exe 85 PID 5272 wrote to memory of 3100 5272 chrome.exe 85 PID 5272 wrote to memory of 2740 5272 chrome.exe 86 PID 5272 wrote to memory of 2740 5272 chrome.exe 86 PID 5272 wrote to memory of 1640 5272 chrome.exe 88 PID 5272 wrote to memory of 1640 5272 chrome.exe 88 PID 5272 wrote to memory of 1896 5272 chrome.exe 89 PID 5272 wrote to memory of 1896 5272 chrome.exe 89 PID 5272 wrote to memory of 3976 5272 chrome.exe 90 PID 5272 wrote to memory of 3976 5272 chrome.exe 90 PID 5272 wrote to memory of 4992 5272 chrome.exe 92 PID 5272 wrote to memory of 396 5272 chrome.exe 99 PID 5272 wrote to memory of 2768 5272 chrome.exe 100 PID 5272 wrote to memory of 1884 5272 chrome.exe 101 PID 5272 wrote to memory of 6108 5272 chrome.exe 109
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec1bdc728,0x7ffec1bdc734,0x7ffec1bdc7402⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,14496410620730877971,15254025503107997205,524288 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:32⤵
- System Time Discovery
PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,11423672213475253466,7479438938633635970,262144 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,15417202277030356697,9717603706038010353,524288 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:82⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,14085218244831865636,7903208662600655514,2097152 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,17374935701996392944,12490175312820599406,2097152 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,2144009525498179187,7027155724161378529,2097152 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:22⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,9964983111439813864,7123969610215996399,524288 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:82⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,16169161918092281349,4598180330800361704,524288 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:82⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,15873501118713780882,12819418222427328635,524288 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:82⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,2718974905466559222,3233496563296493041,524288 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1080,i,8784733253555536756,2176639164818651776,262144 --field-trial-handle=2012,i,16628119293655878604,12404522512050436601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6108
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 c387b5d45a8e5d3f071b4eb15bb74d8b2a7948eba325a224acadfb7ae71a6205
- MD5 72d27e0116e45f959e2c76b9a0b255f5
- SHA1 19dbc1dca3b8a39edcfc4df5da8bee64cd702022
- SHA512 b78947becc8b0b0407283dbd342ecca3084e8f56108a9c858eda8a65a913620aaf9942716908e1ba51748fc262277e0f2d64d9e1b9192bb96a8b65e6be91ad5b
- TLSH T189E02BA9C9A1EC3719FD175DA0500749EA5513073740494F3E3C9D184F7863E4656C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 1b641e6b299882bc05dbea8a97955891d178e2d6b015a2e87ddf332c6b2518c5
- MD5 c17be9448a1afefe455cdcb845c548dd
- SHA1 701de2b23a379403286dac053d06b7c360b221c8
- SHA512 0f29dcc9151efb33352038021059d47da318fe289052f3a2a4c1759c2298992d183a39d3d18be04875b6f96ac6f15a6962dd4b03507a405214ccdbcd2313f0b0
- TLSH T130418CF793F4897E8A1196E4EB156E1FCE690524032C3CA689D4AE2B43F2872D10178E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9c3f55878c48938fc40087635d5791009bc1a73d666dbe6eb1e7d456b4110218
- MD5 4b403a8e3926e46d84111535934fe44d
- SHA1 777ae69bc142194e5d3c40fbb29a4db8277ce75f
- SHA512 4ecb7390c8597c47809bf3a21ec46563e423f19f3f11e2b9ebbb4ca3578383c2aa768742d1564d53d31d199225f6f13a3bc92ad97ba02caab8ce90965abfa5e6
- SSDEEP 192:5RWfr06VA7Pppv71hpAPRp2O992Hsb+WNnyeP7f2xzFeQXtVyIsnAUge:5RWfo6spBhUXFQwHPD2xz/re
- TLSH T17342C66EAE10697B6CDBD22AFD257B53D7F5102121E21D80E6FC892C19D76CC223741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 8c65aff4bdfd7cfdcc7740b3831bc713f5923471d38519ba21743d3986d33ba6
- MD5 75f40d3bd6c02d459cf34b28c512e876
- SHA1 927e9a29909126ff2747380f050610d1b6f58799
- SHA512 62c2eae0ceabad4f8451f26d3b1aee274bdceadfbd5ab609bc14b710518ec3ac5923700626564819346b241d32610f7ff212c5fcb39c839bdc5fc3782833edba
- TLSH T134B0128080415202C00203F4218264C8B214BF10AB0A170283E0A93688351508014450
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5888a3.TMP
- Size 96B
- SHA256 5c006302633fe7954268dc0b01a20e4490baff84fd963c3bcdca772d3252b609
- MD5 7ea8da61dd86244925f1c46ec4a6f9b5
- SHA1 9135acd45a1415e3304d1733311a7a3288b3676f
- SHA512 aa76d043da6f7c2c00ad235456e92ca60bfa460aa564a261b8d01ffc6030ef5b3fdb65a0303160442013a6c7b5c86049c72031304bd46ee172b469605e2c1d3f
- TLSH T152B0222AC0022222C00203F03880C0E83028CF20C303222E82E00BF2FC202200320820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d741ec8569bbbbb6779f9ac5eb6a2c2d5134b7505f0c22408469d6c49a64e72d
- MD5 09e626740161ce06276978beb1086549
- SHA1 fa1b08311b94dcc7ae68aa67f15173a95c20f45e
- SHA512 efa7721308dbf6b2c7df0162aacb4b604f10bb8c12e218ec300e2c8b0882b569c33266a69be87ffa28d9617eefb07a0967f3e718b70decefdd6d2de0a3248ab2
- SSDEEP 3072:WGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:hm7Rkm1tYpBeh2BAo3
- TLSH T15DC3123B5D75A8375DB9BB4EB04E0A1F1EF24AA6C930DE52C8D85A0437ED7CC1A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 9a88a1b100dba3835761583255f197359343628b555f88c952bb3f62a04a2e5f
- MD5 88095f7b3c96ce2db476e874ed93b156
- SHA1 7679bfd82483673902430c57a0fab09c554a66c7
- SHA512 c85f12e05fd3af41e4143cff161e6519f9dc9c72e1a93df39d8acf85489868761ed27f70dcf9a70e54a37bc2e117a54702e11de21bfef3285b9c383dd38bf7e1
- SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:wm7Rkm1tYpBeh2BAo3
- TLSH T1FCC312275D71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D86B0437E97CC0A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 34f2a88b5957a9c092755ee4059e4c7fbaa88cb9bda42232b309dbb29a33fc48
- MD5 acbdc41029744dc796c0ff13c8d42c92
- SHA1 d3879ad96ae205a99a093e9c42f5682dfc1d0d0b
- SHA512 8602d8932d64e0c13dab42646475c12aba9395ba8ea325888391ba34560669fac6de0f0574ced4b214c4b212c25d9c76157ef7d95d4f44e6e8b2aa7609fb6f0b
- SSDEEP 3072:2Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Bm7Rkm1tYpBeh2BAo3
- TLSH T153C3122B5DB5A8375DB9BB5EB08E0B1F1DF14AB6C820DE52C8D45B0437EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 44648e5f248e9572dbe32899b8dc81cba9a0c7b0eea1766dbd6553cc62e11ac8
- MD5 a278848418eb79e5c018646fa90f3c01
- SHA1 7a2e7fab08332f0c6d7b3d9c3f3220161214c5b9
- SHA512 a44c8414b304ba348878f78f5026a02da6d3bc8ff9d0c99bbcfc1e2b92cc97c842e443538dd96c769c3e58dc6b13278e3319ce993c53859d2a36e306d26bcd2a
- SSDEEP 3072:zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Km7Rkm1tYpBeh2BAo3
- TLSH T122C3122B5DB5A8375DB9BB5EB08E0B1F1DF14AB6C820DE52C8D45B0437EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH