Overview
overview
7Static
static
3Xeno-v1.3.40.exe
windows10-2004-x64
7Xeno-v1.3.40.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 04:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.40.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.40.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20250619-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260506-e5geasev7j
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5056 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225157382809396" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4744 chrome.exe 4744 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe Token: SeShutdownPrivilege 4968 chrome.exe Token: SeCreatePagefilePrivilege 4968 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe 4968 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4968 wrote to memory of 2092 4968 chrome.exe 80 PID 4968 wrote to memory of 4272 4968 chrome.exe 81 PID 4968 wrote to memory of 4272 4968 chrome.exe 81 PID 4968 wrote to memory of 5056 4968 chrome.exe 82 PID 4968 wrote to memory of 1548 4968 chrome.exe 83 PID 4968 wrote to memory of 1548 4968 chrome.exe 83 PID 4968 wrote to memory of 1228 4968 chrome.exe 84 PID 4968 wrote to memory of 2424 4968 chrome.exe 85 PID 4968 wrote to memory of 1228 4968 chrome.exe 84 PID 4968 wrote to memory of 2424 4968 chrome.exe 85 PID 4968 wrote to memory of 5008 4968 chrome.exe 87 PID 4968 wrote to memory of 5008 4968 chrome.exe 87 PID 4968 wrote to memory of 2372 4968 chrome.exe 89 PID 4968 wrote to memory of 4412 4968 chrome.exe 91 PID 4968 wrote to memory of 1856 4968 chrome.exe 92 PID 4968 wrote to memory of 744 4968 chrome.exe 93 PID 4968 wrote to memory of 4744 4968 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e4f6c728,0x7ff9e4f6c734,0x7ff9e4f6c7402⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,7046481423425482623,10633544694876559768,262144 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,8452959448142303746,13636927946942525018,524288 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2220 /prefetch:112⤵
- System Time Discovery
PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,7616270135197902745,16891473172467723291,524288 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2372 /prefetch:132⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,6194819634663411131,11939775501236289140,2097152 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,4815830899517556853,13155408156941222948,2097152 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,2973090747953148080,11343717946403369874,2097152 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4324 /prefetch:92⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,1276754599117397223,10797988692909294490,524288 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5220 /prefetch:142⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,10733850573016158267,930790129281072188,524288 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5280 /prefetch:142⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,2092234599934491791,13866416604420614882,524288 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:142⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,9335682840232417829,17441892619851986343,524288 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5472 /prefetch:142⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5404,i,15016702437945394768,1066060192907655015,262144 --field-trial-handle=1960,i,8028196357584406259,17622624532644395427,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5472 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 8bf2ac6716d252610c8068471976fc57827b56d3cb35c00d13e8dc459e0f3269
- MD5 89ac938b8c2c31312b82e988cf5064cc
- SHA1 83309f08c42c56fb13b409cdf6302b93164b0374
- SHA512 ed28bea8fc0b31a7327740ab8e379d2ab6e06c1a148c76ca1baa7637e0ded56386b3b7727d6f32c5c4c98c0304e253a28ef50fe29df8d0a18670535ad0fb0f9c
- TLSH T17FE02BAADC22D82B09FD0B2A605087C1F70003176B51855B373D820D4FB127705D581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 2e361f1fdf40bec4ceb37016f81b34b45020c46a4810e1ac7820c3a42b98c08c
- MD5 4c403a141ea965dfdcb3d121e04ada18
- SHA1 699be6658aa8e274ace607dadc3db7b217d4ebc0
- SHA512 20cc263e9df5e94d59573784cd38dc9444c01d9b5e128685de9d8b53b2322bb67ec893a3902a53e8686f2c0599f726d02caf1fe59746ed7cd30838342cd2ed3e
- TLSH T106418BF793B4997E8611A2E4EA156F2FCE7D0524131C7CA689D4AE1B43F2972D20038F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 29cdb782f5561edc073d41cb5829aab5c191ee38b86b76ec4432bd648641528b
- MD5 ed80cb58233281e7e1c46a850ce4af91
- SHA1 dbb39d24d1d694b5ad556a8cfd3a3cb67260cdec
- SHA512 abac8b4c8e609a1c76b7d46b9b9a7d3c246379d47ba5cfee7b0db20b687a28713ddb067c96a171f0bd9e36d0f58f7181ac637a242a74f19392548276bbf9cf0b
- SSDEEP 192:NRxBZuBJWlZRvv7dpAPRp25x9ZHsb+WNnjVPcEba6TCv+VyIsnAUge:NRnZuBanpUXwHwJPDa9v2e
- TLSH T1BB42A62EA914793B5CDAD229F966BB17E7F5102171942EC8E7FCC62C04E7ACD221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
- MD5 6c2a084e9725415d6e6f241570b51988
- SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
- SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
- SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
- TLSH T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d9602490d3bdd52593f6eb19f63a6bad7061362a3bf7e3f6a71a2c19e9145abc
- MD5 653d7fb80fbeb77321334d6f6f2eeab9
- SHA1 5f9dc8ecf429f03301fca9c342429c9f72df6957
- SHA512 2ce01b7482fc364c908af4f5c3e30107d4b9b5df1d00bca0d9927a7e5577aac1a38142b4b988540d45d02911b4fe733beb720e6f190fddaf1bb57d165e6de410
- TLSH T181B0121080429541C09702B01182448875145F2487051301D3E06971D8261B14024190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5864b0.TMP
- Size 96B
- SHA256 d99fd762812edee69957178216b57a6619d2908d68ebdbb653442d7215c6016d
- MD5 febf17d4210685d40043693f61ba786c
- SHA1 6dff4cd5cced66cd509238b295b7009f5e71cdda
- SHA512 b43d3ee613f270b0f71e29e710d90edeb12f06ac87613f0d49e00763b9465fc97c608a189bb939fdca69098bdd948539cc650196650a0a6696180a3ad089a263
- TLSH T125B02200C0022222C00203F020C880C83020CF20C2030302E2EA0E32CC202B002B08A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 bd2e6e1a00fbb9ea06264034b3d5b0e95734f83a21061c11df67cad1b936673f
- MD5 60ce12de70f334f39ed4c86d304ef171
- SHA1 2819c4c0771f4053aa2c47f0972ecb4c6987387a
- SHA512 90214a89aab7d2cff052bc0410f7c126cf86f17cd1be2d250b732285251d3f4ceb4f72a004f770748db0485213bc2bde70cbf03e0a5043f0b0f7ab5d57322756
- SSDEEP 1536:eBjGP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:Ijc++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1649302B9981E7C7953ABD69690079CAC8CD3CCCE2518257C30C76F0E14BA3D2A35B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 6b59af36b1edca6f2f392b6e30dc642b7b0cc6e0f2810be27b4e1425ea88f9d0
- MD5 7f1f966d8cc0870db28be921849f967b
- SHA1 c050ce8501d5cf9816f67eab2eceadcb3f570394
- SHA512 c173f75cfc28c43a05421674c3fbb8e7c8954ef746af25bac8bd3ff98299f0ff7459309aab8e4f71776ec4d1578328f609782a5c19a36cd41690801d39548ce4
- SSDEEP 1536:e8xmaP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:ZZ++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1DB9312B99D0E7C7923ABD6A690079CAC8CD3DCCE1514157C30C76F1E14FA392A35B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 b7bc8269b1c3acadacaacea58bce0c81234886a1329167dff3b0cb61b6db2347
- MD5 b2b5a532d663a1f32266f2f35935e8d8
- SHA1 2ba236cd662ebe8ce0cd93d999ad294d45513cef
- SHA512 a91b3e74d513b06fffe67ff162d2e0f2169c037dda3a9053efeb743ee1baf8ce27c59a207bff1dde5b122ed24d93dc907e8c7a3988369e02729a98ec0fc8f90a
- SSDEEP 1536:X/P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:X++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T19D9312BD991E7C79536BC696A0079CAC8CD3DCCD151451BC30C76B1E14BA3A3A31B8E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 77f2920bd9dc70ceb10a1ad2fe410c7c39a8efa05237dd07e7f6341b9e1a1bd1
- MD5 4ff84c31df2ab3cca146b174a11c9293
- SHA1 76e20ecf31fe5f59e83b3625e00a2c903c387d60
- SHA512 6fa5e4fdea09c0006c8baf2a8babc89c150fb9359a365d4ee62b744910731af34caee08ef2a2dd7c3932223e1f1e13fcbd94b359e7afd7b1e646fbbabfd83221
- SSDEEP 1536:/8xmaP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:2Z++J3qUQm08KMWF0bFTcVHr6zb
- TLSH T1E09312B99D0E7C7923ABD6A690079CAC8CD3DCCE1514157C30C76F1E14FA392A35B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH