Overview
overview
7Static
static
3Xeno-v1.3.60.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
3resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows11-21h2-x64
3resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows11-21h2-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...rt.dll
windows11-21h2-x64
1resources/...se.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...b1.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
162s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
14/08/2026, 19:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.60.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/libssl-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/msvcrt.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/ucrtbase.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/vcruntime140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/vcruntime140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/zlib1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target resources/public/api-ms-win-crt-environment-l1-1-0.dll
- Size 18KB
- Sample260814-x49css1scs
- SHA256 f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1
- MD5 c712515d052a385991d30b9c6afc767f
- SHA1 9a4818897251cacb7fe1c6fe1be3e854985186ad
- SHA512 b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2
- SSDEEP 192:sfW1hWiQcvHCjdks/nGfe4pBjSY6Na3sAW5RKTt3E2sVWQ4GWIjcyqnaj/6g6dqd:sfW1hWPQim0GftpBjzim3StltFpn
- TLSH T1F2822BC69ABC9543F9C3AE7052B8EA877D3DDBC31D20812605A9F5982CC73D1EB1092D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1400 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312095649101751" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3836 wrote to memory of 2604 3836 chrome.exe 80 PID 2228 wrote to memory of 4560 2228 chrome.exe 82 PID 3836 wrote to memory of 1232 3836 chrome.exe 83 PID 3836 wrote to memory of 1232 3836 chrome.exe 83 PID 3836 wrote to memory of 1400 3836 chrome.exe 84 PID 3836 wrote to memory of 4644 3836 chrome.exe 86 PID 3836 wrote to memory of 4644 3836 chrome.exe 86 PID 3836 wrote to memory of 4104 3836 chrome.exe 87 PID 3836 wrote to memory of 4104 3836 chrome.exe 87 PID 3836 wrote to memory of 2200 3836 chrome.exe 88 PID 3836 wrote to memory of 2200 3836 chrome.exe 88 PID 3836 wrote to memory of 4032 3836 chrome.exe 90 PID 3836 wrote to memory of 4032 3836 chrome.exe 90 PID 3836 wrote to memory of 440 3836 chrome.exe 91 PID 3836 wrote to memory of 440 3836 chrome.exe 91 PID 3836 wrote to memory of 4724 3836 chrome.exe 92 PID 3836 wrote to memory of 1824 3836 chrome.exe 95 PID 3836 wrote to memory of 1824 3836 chrome.exe 95 PID 3836 wrote to memory of 4108 3836 chrome.exe 96 PID 3836 wrote to memory of 4108 3836 chrome.exe 96 PID 3836 wrote to memory of 5520 3836 chrome.exe 97 PID 3836 wrote to memory of 5520 3836 chrome.exe 97 PID 3836 wrote to memory of 724 3836 chrome.exe 98 PID 3836 wrote to memory of 724 3836 chrome.exe 98 PID 3836 wrote to memory of 3572 3836 chrome.exe 99 PID 3836 wrote to memory of 2304 3836 chrome.exe 100 PID 3836 wrote to memory of 2540 3836 chrome.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\public\api-ms-win-crt-environment-l1-1-0.dll,#11⤵PID:4196
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf33dc728,0x7ffbf33dc734,0x7ffbf33dc7402⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,5265709258795921267,3120641644865877707,262144 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1836 /prefetch:22⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,1473309905506022959,14308490647479495118,524288 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:112⤵
- System Time Discovery
PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,490540923658914221,8486296073395279259,524288 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:132⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,11380952675565594770,4043689790196215756,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3408,i,3590641897919125376,7233382257243253343,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,5917025607120136934,12584136601013159099,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:92⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4852,i,9445375451220715014,6143657594056389635,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,7223543115120832774,1238013786332288078,524288 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:142⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5836,i,12631603806503883129,17557654831051773144,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4908,i,16352528944251111622,5210803737297921607,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6064,i,16631771808153879567,4876012036730081930,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:5520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5876,i,15657336293489566719,12974503864674406116,2097152 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,16117275267854514729,10134533400150274753,524288 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:142⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,12195036944599900584,17728335085095495268,524288 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:142⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,2974543180860074824,112126696468209016,524288 --field-trial-handle=1840,i,10840743670430308781,14768011964020041139,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:142⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf33dc728,0x7ffbf33dc734,0x7ffbf33dc7402⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 62943e86a1df19d3b3008bc9f5468bf708a204376798193da8120ab1ea31c435
- MD5 9e7234efee55692aa3877233e769f1d6
- SHA1 821b9927ed54b4123aced604e85481b1b7de4b5e
- SHA512 b636b177b9b6f361dac911cd716f2f2cb3e76bf334c788a6a3753c0989ab2b204785e6259c4a8539139703711e220e4ce2b3aa6711b79aebe25daa8fb77ba1cb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 0cf8482edf76599a1bc5ffe2e6056d7b8373cdc40caad677204d83e1e6bac256
- MD5 8858651314f927524a47ff5d8357586a
- SHA1 beddfa8ba6bc9c9e8adc736dd584afb8e16df243
- SHA512 834074d4251028c51d8a39095797ab24bba7fc20b0cead184771b4c0acc00f4efac3c46bba4ebc6105407dc2bc462aeeb98880aac45c26f68339bad4f4ec6f7f
- TLSH T16DE02BA6C825AC671DFD2B2C61510345D76003172B80699B3F3DD11C8FB1B3A418581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
- Size 335KB
- SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
- MD5 9f9c9ac1a584487d0961c6af2cac057c
- SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
- SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
- SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
- TLSH T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 2d24073f98e62d8c545b05c16636b848f2ad6ea30c0f04b9abb930104770e9f7
- MD5 aa93fe5dfaae992089ad03e0410c2750
- SHA1 b5f426ae973414a17c3c9f113ceef1c5e3d369e7
- SHA512 6863a4a9d421ce03355fe39a212a90a4e90569e93c6dfb2ae31492eca0c867d015f52e1fa67c7d5ec1a7a230e11a76255687e78225d52a008d29e87adda65daa
- SSDEEP 192:fR4dvAbYQMv7HpAPRp25k9DHsb+WNnh2gVS2rAikohkwHVyIsnAUgtaJ:fR49cYjUXr5wYx20qB8
- TLSH T19D42E82EBD50663B5CCAD22AF9557B57E7F5102125C02E84EAFCCA3C14E75EC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 1732b486a29cc3765d431e0788e952f3c9fe3004b548731138cb2738bd0c8212
- MD5 e37ec31327a0500e356e93ced46ce066
- SHA1 e13bcabdfa87953a293a01baa64b070150944556
- SHA512 1eca41f4e2b366195d5b97eff979485467b6a68744ef558404a526775e767b5df89c49e6f175cf69238271030898917eadef496f2e40a1704ab50a601cbaedfb
- SSDEEP 192:fR4dvAbY7Mv7HpAPRp2Tkxk9DHsb+WNkph2Bgh7VS2gAikohkwHVyIsnAUgtaJ:fR49XYjUX25wJ2Y2tqB8
- TLSH T10252C62EB9506A3B5CDAD226F9157757E7F5102125C02E84EEFCCA2C14E75EC322741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
- MD5 a9125c26694a66613be5174b13bd716c
- SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
- SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
- SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
- TLSH T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 b76f7b0c0bbc3a8af45b3b5c4b8ff0193fe65be69dec794066a757759745723f
- MD5 c2a81f5d0f09f5179bb27f38b2af30d7
- SHA1 44d4f3aad21b0e5c2db8d48441551fa04287fde2
- SHA512 997caeca1ed2da979997db117a9d83c65a2c737d96176dcd4ed95e75bb76daf6744f66f07df964cdfcafbd186f2caa2439baadd2cfd47802437febd52fe964f8
- TLSH T1FCB012118001A501C05203FC1242648871146F10960F170243E0B923C8396618414160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a67c4.TMP
- Size 96B
- SHA256 3b45fcb0cd5524cc9a5651ae161064eec1ab806254caf89772225055fe1adf51
- MD5 b29b57ccab390406a3152a13eb762874
- SHA1 8424c6a90dd8cd917beb8343387a4a007adcdcfc
- SHA512 a47a6f0f440577e55dfd1427733b1303fe8691ca761e2e0e740c5b554774f5bb76fa8d43348f51fb641c6f5ea591641432844383685e353f12eb6f31cbc05383
- TLSH T1D2B00256C2027352C25203F43599A9D87160DF65C6271752D6E0DA76FE3AB7245251A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 239KB
- SHA256 bb683d2e5dcae3525cc666813d10ba17eb20d98bc976d5aa8fadbf8eaf2133d4
- MD5 d491999154094169b46357320f869732
- SHA1 3197469c1ce8a3a8f304b449cd94977e4fc7051f
- SHA512 ddeeb56336550d6976c36ec7a9c809059e6f5bfda5bc3fb8c21827e6e8776c729aa5dcdb0baee23c7441db09a4a47f8edd2b17e2b93ea44ce9846a01df712ab3
- SSDEEP 3072:93mvJqRV4zRLEzdguSFqMCIpI1gl5R/Kf+MGm7D5Lk17ox1tIpud63U8BehbCBij:4vqV4z6Zn2x3/m7Rkm1tYpBeh2BAoa
- TLSH T1CF3423375F31A77E1EBDFE68A08D032B6AF64CF28458EE5384CC6E0426FA7911502934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 22875a9901b9072106a355d264aa2df7814c511ecccdb80733888cbc9f1d59b1
- MD5 1820cea1fa0f28032bf37f34da94eab5
- SHA1 270210db2b1ddfe91ab7171fa6693e4abb089e11
- SHA512 5262022c6583435a5cf3391d3a6f90a036399f5a36eee7b2194e2007f3cf8454349d55cc9b4441b39f1181aca3b19e9c1940e5b9602c8b6287dae2e080fd0a5f
- SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:lm7Rkm1tYpBeh2BAo+
- TLSH T186C3122B5D71A93658B9B74EB08D0B1F1EF14DA6C930DE92C8D86B0477FA7CC1A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH