Overview
overview
7Static
static
3Xeno-v1.3.55.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...-0.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows11-21h2-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...rt.dll
windows11-21h2-x64
1resources/...se.dll
windows11-21h2-x64
1resources/...40.dll
windows11-21h2-x64
1resources/..._1.dll
windows11-21h2-x64
1resources/...b1.dll
windows11-21h2-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/07/2026, 04:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
resources/public/Xeno.dll
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/libssl-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/msvcrt.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/ucrtbase.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/vcruntime140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/vcruntime140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/zlib1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample260709-e1fl7scw5l
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1684 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280451297974750" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 3780 chrome.exe 3780 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe Token: SeShutdownPrivilege 1356 chrome.exe Token: SeCreatePagefilePrivilege 1356 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe 1356 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1356 wrote to memory of 4916 1356 chrome.exe 79 PID 1356 wrote to memory of 1696 1356 chrome.exe 81 PID 1356 wrote to memory of 1684 1356 chrome.exe 80 PID 1356 wrote to memory of 1696 1356 chrome.exe 81 PID 1356 wrote to memory of 3640 1356 chrome.exe 83 PID 1356 wrote to memory of 3640 1356 chrome.exe 83 PID 1356 wrote to memory of 3528 1356 chrome.exe 84 PID 1356 wrote to memory of 2492 1356 chrome.exe 85 PID 1356 wrote to memory of 3528 1356 chrome.exe 84 PID 1356 wrote to memory of 2492 1356 chrome.exe 85 PID 1356 wrote to memory of 1068 1356 chrome.exe 86 PID 1356 wrote to memory of 1068 1356 chrome.exe 86 PID 1356 wrote to memory of 2736 1356 chrome.exe 88 PID 1356 wrote to memory of 744 1356 chrome.exe 90 PID 1356 wrote to memory of 4748 1356 chrome.exe 91 PID 1356 wrote to memory of 1288 1356 chrome.exe 92 PID 1356 wrote to memory of 3780 1356 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d449c728,0x7ff9d449c734,0x7ff9d449c7402⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,15406084356117027599,4324259261194958554,524288 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2132 /prefetch:112⤵
- System Time Discovery
PID:1684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,883749443149546625,2371178720332337988,262144 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1868 /prefetch:22⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,889392876624513935,1953744220577422585,524288 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2204 /prefetch:132⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,6193623423692933353,7622626293788903550,2097152 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,11428993318517473802,17977195957436178213,2097152 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,8533211422550478205,7398239993171343041,2097152 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4288 /prefetch:92⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,1306044339578397730,14681961929393977704,524288 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5340 /prefetch:142⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,4840849956864395510,12385539915158160562,524288 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5812 /prefetch:142⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,6091761325248510757,16010973844859702665,524288 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5648 /prefetch:142⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,12585942133710810547,10366767479377623012,524288 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5764 /prefetch:142⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1064,i,9500983944366689907,4736541993263062232,262144 --field-trial-handle=1936,i,17241322214906430671,7323287309432237663,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5336 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3780
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3376
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 3a28a8345189103d5041a930c3191946b39a5e9c32199256824c669416a5b824
- MD5 db749da4f1bc1051a0f58b452fd3a6c2
- SHA1 1928092aff550698425ceec6d17fc6f06a4982fe
- SHA512 b0c92fb65498852e8bd982b6f364628650771f6174b36f2830f36a87eac2e36a2b84129b683fd445ce9034cb37c6f5eb0b911af3e1770e453e5294a7946ba0e6
- TLSH T197E022AADC22DC3B18FD0B1D31501A82F601031B3B80A9AF773CC20D8FB467E05869AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 cab9b93c4711ae5f79f92d1ea3e7a10db48b0b267738caa81e6f8615f0429b0e
- MD5 19b62c87dc8b190a22c7c2d04b15215c
- SHA1 48d43d502f60e25f47121ffc2fe6ed8b7517fb11
- SHA512 4f63eea62f3a2d2cb0d149cf2307d014c57597c71e95ec253bf4f5b489693d13c2961ac146c7a96081c6d44a1381ae764d4371625360af34634bf8272efc3678
- TLSH T190419BF797B4897E8A1192F4EA156E2FCE6D0624031C7CA689D4AE1B53F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 e61a7738d6b0b48d3d383fa3b5593480a14b5e7f742b774b2441c48857392e80
- MD5 bc6a536cc51dc541f9de609510b567bd
- SHA1 9ff4d49547669b6b839dd4d87ffd6cb67790c9fa
- SHA512 fa18e85292c3af5ce6b55e23caccfa79fa35ddec89fa534ad7812e8cf1b6153c0974eeed417eb449c67177a3226b95e1401c85ef8f8f6877f1fbcb9c47301f2a
- SSDEEP 192:GRZZCpl6DoPJv7+pAPRp23ry9uHsb+WNn/0rPAee7bwt26w/VyIsnAUge:GRZZqPJ6UXEyUwiPCby26Ie
- TLSH T12142C72EAA11757B6CDFD229F9227B53D7F5102221D02E84E7FC9A2C15D79CC221702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
- MD5 04c2655e775a571e3b09dcdcd782d924
- SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
- SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
- SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
- TLSH T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d59627656dd769066e39e48e4d9e05a584b3e7ba84d19292ec8e4c3582dd01cb
- MD5 ce723d88d9411a389aea1800e744aaa1
- SHA1 eeb82772b913176178192c2ee5cb971df979114a
- SHA512 2448de5ba8e90aa4060a72d41b18b5e11664f8ab8cdbd3236bb12d9bc4e8258c70e4e457464945f605457bf8448157ebdf3f21639f9aa0ce823213bf94f3fbec
- TLSH T167B0124088025541C08603F4124324C871149F14D60B270183E06A278C25590C015050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588894.TMP
- Size 96B
- SHA256 6b9a22458fb600b125593027f15878ebdc1fd73126cfdd876fc05b13acfa4f38
- MD5 f3e4706e93449fcf994f7466f763b2c6
- SHA1 b5752205c76d235556b942f9bf69540208e9bbb4
- SHA512 8c1c6537916c1e9ecf3f8c17420ae986ab7a8aed7592b80cf8c7b96a3193f26f4b823fe7e52921010e5d4f801b9060c1eb08bcbe5357fc807312b58b05d6e3bf
- TLSH T149B0220AC2022223C82203B02C8388E83020CF38C20322A3C2E00B23FC202300030020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 bb41e911bcb23cafea753f9494b2455c5b24dd2ca8886635395d9e95b5ec4c27
- MD5 67b765e521567eec91da6446534d16b3
- SHA1 f8e92e9eab6a3e2197642350405c692a6954ed55
- SHA512 13927727b0d3a65a52991956a698d62852e5f3e0a2c6e30323ccf4db77a84edeacb3c54950b1ba319933957d6ac8110a9ed5be619d3a477fe44e42c96ab27e42
- SSDEEP 3072:GO8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:G4wCcmXKegIh6jh9JvexhQ
- TLSH T104C31259281B3DAA8CFD7DB370433782869613A66C05F04EA4C8DF0A45DDDF915EB4B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 31cc8156207334e605e883c73ec762b9b90a7742a0d658a774d5f0dc0733185e
- MD5 2b5c5066b7a5d7011ce383e85c7cc472
- SHA1 65c1f66595213cc56faba7676511465898cc0723
- SHA512 3018b8f8066742488fe39be2410ede033d296904d19d360c8fb4d69bd182df59fdecfcfe6a4220342ba7b06d97f643b27b9bc47df886578cfe4afc078092d51f
- SSDEEP 3072:I8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:OwCcmXKegIh6jh9JvexhQ
- TLSH T186C3126928273DA688FD6EB3B40733828AA353E66D05F54E90C8DF0A45CEDB415EF474
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 ab6c04cf83be66a3dfecd7d8901d0c2fea32425a9560c0792ae0b0225d0d0204
- MD5 6e7e79b78d79b2ed2f1f46c335da9a30
- SHA1 766f8525f84931beabf4ae84a70e7e22e43bccbd
- SHA512 1efb66fc05481c6c23cafcd691c7e444f1cf4d5ce640aa901de2325d9a007d910d98376511c4a89b67f3e401574d19a9d6c14ebab980a585f0a622c6c513d919
- SSDEEP 3072:98uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:bwCcmXKegIh6jh9JvexhQ
- TLSH T1F6C3026928273DA688FD6EB3B40733828AA353A66D05F54E90C8DF0A45CEDB415EF474
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 5f5418325d8961c04c87a06044d27dd426314b8d1b4ccfafa872899aecc45798
- MD5 f5983af5e0e9d9ef48afd92d6d42d720
- SHA1 2907fc5bfbe416299a9854fca9b0c2ffacd84d2c
- SHA512 4a45a892755616a31d3b7c620863c9c9bb63d419b0bb290c5c6eb4b8346d8b43eb7123321d1e58c333354bb1b3ea8c27af739a94e5daa7a6587c8351d1352484
- SSDEEP 3072:68uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:cwCcmXKegIh6jh9JvexhQ
- TLSH T136B3125A28273DA688BD6EB37453338286A353A26C05F14E90CCDF0B45DEDB415EF8B4
- MD5 SHA1 SHA512 SSDEEP TLSH