Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows11-21h2-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...rt.dll
windows11-21h2-x64
1resources/...se.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...b1.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/07/2026, 04:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/libssl-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/msvcrt.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/ucrtbase.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/vcruntime140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/vcruntime140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/zlib1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260709-e1fl7scw5l
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4704 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280451544234400" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 5336 chrome.exe 5336 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4544 wrote to memory of 5136 4544 chrome.exe 78 PID 4544 wrote to memory of 4704 4544 chrome.exe 79 PID 4544 wrote to memory of 2940 4544 chrome.exe 80 PID 4544 wrote to memory of 2940 4544 chrome.exe 80 PID 4544 wrote to memory of 3488 4544 chrome.exe 81 PID 4544 wrote to memory of 3488 4544 chrome.exe 81 PID 4544 wrote to memory of 1956 4544 chrome.exe 83 PID 4544 wrote to memory of 3904 4544 chrome.exe 84 PID 4544 wrote to memory of 1956 4544 chrome.exe 83 PID 4544 wrote to memory of 3904 4544 chrome.exe 84 PID 4544 wrote to memory of 5452 4544 chrome.exe 85 PID 4544 wrote to memory of 5452 4544 chrome.exe 85 PID 4544 wrote to memory of 5480 4544 chrome.exe 87 PID 4544 wrote to memory of 3224 4544 chrome.exe 89 PID 4544 wrote to memory of 3220 4544 chrome.exe 90 PID 4544 wrote to memory of 2932 4544 chrome.exe 91 PID 4544 wrote to memory of 5336 4544 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff47c728,0x7ffcff47c734,0x7ffcff47c7402⤵PID:5136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,18384441869350210097,9690044992795223868,524288 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2236 /prefetch:112⤵
- System Time Discovery
PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,15077701996755989218,11117871447310568577,262144 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,10941428835585432659,10602799078295283576,524288 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2244 /prefetch:132⤵PID:3488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,4471459998487706244,5464781678447886666,2097152 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2784 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,17440085939379184649,11640108326740529324,2097152 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,9136016649021977856,15384298742232435626,2097152 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4320 /prefetch:92⤵PID:5452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,7113576653958286349,8483924796789436922,524288 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5336 /prefetch:142⤵PID:5480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,5741987682466403011,7631136606128124718,524288 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5352 /prefetch:142⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,955100681952555191,15429660305072591692,524288 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5444 /prefetch:142⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,17067189808189250082,9573934800832225369,524288 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5636 /prefetch:142⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=744,i,13609270270305595985,3704906119109339466,262144 --field-trial-handle=2208,i,6653811172711162203,12635789937166928248,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5364 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:5336
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 c5cef8ba4be7ce3c715d2ed34028c043c881d245be6485bef6682738c1f55927
- MD5 1ad79e5eb7505e0daadc2a8613cbb7f4
- SHA1 9f4c472deae36866cc916afc9f4e286c87341bc6
- SHA512 dce2a30bbfcdc80a4afcb2d4f77e50a632c68acc0aa33323a78fc67ae9b1a078d42689844fcdd1f66ccd71963f581f0c38e4f582e7f626305b8e71a8e933c85f
- TLSH T1D6E0E5A6CD21AC3718FD471860508786E64113573B81890A373C52089FF56B74156C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 4c409a184dd3a12e67e901e91f96e3fcbec166588b09919b4d87e6601be05330
- MD5 8f23a69abcfcc7d0e58666f67ee37d07
- SHA1 9f0262e6a53e0246860de3aae42dd41a2255204f
- SHA512 30b3c8e1c2e8bae02e1abb9b75e2d794dfcf4a1c40abd7d1aeb787540789c08186b5759b917b37a4a14c92f161d8f7ab58c1fdeaa067a2133a4f96b09631a341
- TLSH T16241AAF793F4957E8A1092F4EB156E2FCE6D0924031C3CA689D4AE1B53E2872D10078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7363e02ed96411e3f8f2a7007b33b3fae76bd22f6f0dce20e400b1db8363e764
- MD5 f21dacd63388df1635e71273bf78036a
- SHA1 1d8d24e7df9d8bfa6a48a4179258fec8ae54501f
- SHA512 88258d428e12b9c2ceb73b89a0d72c96540aa9eb27430d5c38e6528240d41a63ae64f3398afebfbd2a0ca00b958d44b6b852caf4a80dcb141e2c41fe3ae47fd4
- SSDEEP 192:nRK8C7GRZdOJv7lpupAPRp26S9fHsb+WNnTXPiS6ecHnqVyIsnAUge:nRK8UJZgUXqRw7Pi7qe
- TLSH T1BF42B72AFE50257B5CCBD219F962BB53D7F1102621D42E80EBFC9A2C25D76CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
- MD5 5d35f09b8c86835fb4877dcd0cc40e4a
- SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
- SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
- SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
- TLSH T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 6866cf6193e8f477efa3abf2e043ff1f962165ff16dd7aa025d9b1267b54f168
- MD5 7aed70d18725cb7a2a61db31dbadd147
- SHA1 d4d4cd1fbde26476bee4f657f3dda67bd17e5c55
- SHA512 5f8bb5dad9bb81525b07cfcadfdd56c76f18d4b1aff579cd5e5f9ddb028b66c55084c949d31fdfee3f21f5b070c644c9e156dad9866e3f6e87b141c8325e9066
- TLSH T1DFB0128180035601C00203F83182948871249F10AE0A2B0143F4697688251608024050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58972a.TMP
- Size 96B
- SHA256 c5c155ab28f5a58767aac94f71db80b05c20223b5505044519956981de56264a
- MD5 886ca433b05ded9ec4a0e3656b8488a1
- SHA1 16d2093bf8299936dcc5bb53da6e3ca235afcb50
- SHA512 3e564089e5238941303562e7b230310519fa69795296a9bcf7fec20d7cfc69059e947bf2cb95b64143f85b2348655e1a8a8eea0740675a99ad22c1e995e7fe97
- TLSH T137B02280C803B303C00203B828EAA0C83020CF32CB03320AC3F00A22CCAC2A000302A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 56a197d3dead57909af86f9f9f778e24b796d8810037e405472b7179d29a0763
- MD5 f43fcf8b29e4dc1853d93ea5efbe7356
- SHA1 55b29b7d97d89e295b9adb5a6d4830dff6f01cd1
- SHA512 0b43064b431a9d4bc852c3fa6e9e09960692dbefa774d4443d2e8c4036c248693a3f25cc1b7f9658fa8c7afe2b10f798c61e5f6cba90030998950a11c9aec70a
- SSDEEP 1536:3iQueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:S7DFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T132C31212CEABCEABE5A45C79E0C413F3AEBD5F9527F1BA424166A5023DCE7042395730
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 a5fa006ed2d7cfa8e67a74aea0f94dde01691920caae7ab867f69eac37a288d6
- MD5 7012dd8a29173e09d8307ad05ec90ac4
- SHA1 f043a78c75f85a4af1d309d5ff5be4665fd55afc
- SHA512 c019b4accd7a8ebe8cb75fb10b778362969c5944f0f39c2c97519936b7095712c3a2d0f6855c781147ebe9ddcf6de3d2ff19245ce18324a299a43adca68b997e
- SSDEEP 1536:3WKueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:mFDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T11EC31212CEAACE9BD5E46C79E0C517F3AEAD4F9527F1BA028166A4423DCE7442391730
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 ff58b76842d0335119a5c73e154b2461c4dbf9d836a5db5968b57a46cf2a2ba4
- MD5 a8a2662d217017b1e127475029731653
- SHA1 5927e3671c0c2c009e227337fa9487cc09712814
- SHA512 56fd535769cda3ab25bfef64382bdb55c4a619ea4dce6019808e2e01ac2217794abc7c77732b0c06febdde1ab9fba2b43821c3c0be051146571f4c98c412023f
- SSDEEP 1536:neueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:xDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T10AB30212CEAACE9BE4A45C79A4C413F3BEBE5F9523F1BA424166E4023DDE7042395770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 3376031c2615ccef2e3d336afc4953d2591734f4546904a582c96ad3df6c83a5
- MD5 4e23d354ae592d69dc564424f218ab36
- SHA1 eea61fa2047e1525eea363dada7044a84e2b3098
- SHA512 5bc24406ee81d2c8bc9d7f6bc15bb4d96b064fec1d5ff22ab9b339c94fde9fcac1078650ccdabe1d463b12faf7d7a8750bc0ca68607acf4cf60664dc7edc3691
- SSDEEP 1536:0iQueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:P7DFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T1DBC31212CEABCEABE5A45C79E0C413F3AEBD5F9527F1BA424166A4023DCE7042395730
- MD5 SHA1 SHA512 SSDEEP TLSH