Overview
overview
7Static
static
3Xeno-v1.3.40.exe
windows10-2004-x64
7Xeno-v1.3.40.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-21h2-x64
4resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-21h2-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-21h2-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-21h2-x64
4resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-21h2-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 04:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.40.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.40.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20250619-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample260506-e5geasev7j
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3768 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225157116368517" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 3912 chrome.exe 3912 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4012 wrote to memory of 2056 4012 chrome.exe 85 PID 4012 wrote to memory of 3988 4012 chrome.exe 86 PID 4012 wrote to memory of 3988 4012 chrome.exe 86 PID 4012 wrote to memory of 3768 4012 chrome.exe 87 PID 4012 wrote to memory of 5060 4012 chrome.exe 88 PID 4012 wrote to memory of 5060 4012 chrome.exe 88 PID 4012 wrote to memory of 4132 4012 chrome.exe 89 PID 4012 wrote to memory of 4132 4012 chrome.exe 89 PID 4012 wrote to memory of 3828 4012 chrome.exe 90 PID 4012 wrote to memory of 3828 4012 chrome.exe 90 PID 4012 wrote to memory of 2960 4012 chrome.exe 92 PID 4012 wrote to memory of 2960 4012 chrome.exe 92 PID 4012 wrote to memory of 4452 4012 chrome.exe 96 PID 4012 wrote to memory of 4748 4012 chrome.exe 101 PID 4012 wrote to memory of 1336 4012 chrome.exe 102 PID 4012 wrote to memory of 2672 4012 chrome.exe 103 PID 4012 wrote to memory of 3912 4012 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffbdc4c728,0x7fffbdc4c734,0x7fffbdc4c7402⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,10713575728417664189,3054968617469943634,262144 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,3231543463462295076,7682957716521284239,524288 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2264 /prefetch:32⤵
- System Time Discovery
PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,16456005809620130960,4384460904675549407,524288 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2528 /prefetch:82⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,17607588404436875470,11756937522119053208,2097152 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,5722749875931026256,17764876148140223792,2097152 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,17320832455662159039,8815730987208297987,2097152 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4416 /prefetch:22⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,7629005620611072274,1666015486321951157,524288 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,14838758246856035427,5333608299381848564,524288 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:4748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,11849835206678045451,12039744245224215597,524288 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,16039015350909471039,1161058248183753902,524288 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5356 /prefetch:82⤵PID:2672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5544,i,3117808236060125985,9018773510569163591,262144 --field-trial-handle=1996,i,2395269371325117918,4599236818582402204,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4208
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 451e60b7aaa11d85b431d02748aa74cb8cbc61bd3e4101bb2fbbfbc6b431f69a
- MD5 3309555bfb4779d79095d5fa6e97ebac
- SHA1 4c61043e4cd51bc3743cfff3e9c3af910e3a0977
- SHA512 efd78a9e8081aba138e16da7e129df4567fa238e4380da90a213bc914207a21be74c415e2f56819cd232acc9154d4296ef2b0be958f0e19a65b822935b2bbcfa
- TLSH T1B0E022AAC826DC3B0DF94B2961454B45E78023172B814C5F3A3C920D8FB173A468A82C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 020b77e07df355d0d57ccee12090cb5c7cb1601ff89759905f0fec0b37c1196d
- MD5 5ae064762b01e34780fde9eb1d8519b7
- SHA1 99a6092f0b703ef356d0f07970e32daf3be4770d
- SHA512 8f09f125383292b0b691214b77bd84933877e1805012b9f8d168d8fe589f36226dc9fa88bab886fee15bf56c6ddd2e4d0e24b184afcdae66e6142fc2c82cbdcc
- TLSH T16C419DF793B4967E861192E4EA156F2FCE6D0524031C7CA689D4AE1B43F2972E20078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 782d7839d144f52e94f5542260caea2fea56b0ee25c21894444db693495238fd
- MD5 45cfbee69e4c3675ee056091f096f57f
- SHA1 09bb19354a1c484497305c512515ebf6662ba621
- SHA512 48aeac418ac9d33ad185cfa8eee2ab8553400bd7744f86f99726e2bbe53c6dbf5f9f1edb7985d407732b3f5524a0157706295c9a48bb317b60db144110393a04
- SSDEEP 192:cRuwYJUypQwyv7rpAPRp2Uu98Hsb+WNnEJPDPee2u9atVyIsnAUge:cRuhrdeHUXo6wEPb2Ma7e
- TLSH T17242C62EA914797B5CDAD229FA267757DBF6003161882E84E6FC8B3C00D7ACD211705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
- MD5 e96921d5ae30116aafe48367f7ac6695
- SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
- SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
- SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
- TLSH T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 29124a21dc8c122c0c6cbf67e05ad0fd575b7b046a6cdc665d02bea1fcefd748
- MD5 9fd54536e8c70c9de91d73f865403eda
- SHA1 3785cd6120a4f274cca3fb22aef77c1827ff7cbc
- SHA512 a01a7b778112351437b71b81ccc08ff388d35fe0f731ba0ce60db6d8c56d6ee2ff694363382679c18544f864d77c7c979571ef0b4b5db09d0fa756349d82b3b0
- TLSH T19AB0121084015951C15303F11182048C31187F158706130693E46F71D8261A14016151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b002.TMP
- Size 96B
- SHA256 adae13f71943b4a9cade9bd794440a5de31cded724de2af8454d178fa3d4a9ef
- MD5 8a840e7702fd5906f5a55e131aa8159e
- SHA1 10431334e47469cba7b8cb206308aa0616fc0df1
- SHA512 63f7a42be4ae506ab8cdee4db784dde3a06e715a5d4cabf74a939389e8879a22bf1d18505aab8a4fe061334aafd4f817634a182c24ac16023370832f90efddb0
- TLSH T1D6B00259C5026712C04213F0659BD6D97260DF29CB5B1613D3F42B76FC256754927660
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 c677438dc4a795548405d4650b50f72429493cdc9c94112b7da15d31614170ed
- MD5 6fa063bec8747825e6f64f61f921842a
- SHA1 18678872424a42b04837cd7da6a3ace6cd7e0895
- SHA512 ef56d47e18f135cbe9ce359fe04c5c0600a73025639799ce051ab9be1f9c74ef615727f7a5d2c9e9f70c9fc2f81dc6d922fc339f242a4fbcab60354b189d4d9f
- SSDEEP 1536:UVTucYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:oy3Qw/xLANk0mUW5GmRntSFCjEENl
- TLSH T1C69302BA4D2A09E799BE5691729E3809CE12130E716FACCC716C539C31D41C82F73E72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 c0d977b3f5b086d9c3bab9f2530afd6a23303c3a233962bd31af843f24a84a66
- MD5 b13805da990c1dcc6a91b3e88bccea44
- SHA1 7850faf0aa4e3b9b68cacd400cbd37b1c49990f5
- SHA512 a2a884e5f3017f2061d60e529641085812973ed876938865bc3a05a78a6074c9434054f688ccd0ac4174aa0b0b81ba82c78f308840bca28de993205a3b6fa9d6
- SSDEEP 1536:g1cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:M3Qw/xLANk0mUW5GmRntSFCjEENl
- TLSH T1EA9302BA5E2A46E7957E469176AE7809CE12130D70AFA8CC316C539C21D01C92F73F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 1f47e8c0fc089a823b246fec8964c7ebee4ce7e7c9bee8d77921137c0a5181c8
- MD5 b21ce133f88c8f31a0ec28b67ac90ea5
- SHA1 f1ed6d55826fe9a516ea84ed373d6493efa08913
- SHA512 ceef1eb38459681bb53d62af3add73afad43051db180dc8b62c9c7b3bde3ef18ae72e63f780d3bbb261f944e25a1f6988e2400d3e9ee205760d13e2311a96aca
- SSDEEP 1536:D5/cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:13Qw/xLANk0mUW5GmRntSFCjEENl
- TLSH T10E9312BA5E2A49E795BE46D1725E340ACD12130D719FA8CC72A8139C21D41C92F73E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 c46e144d69ee5b7e5063e54747eee2349bfb64a4b7b68a40bc4b02492b3c3bdd
- MD5 45f55944644323191131d274a7cb4ac7
- SHA1 27ecf2fafa69f42ad5e4ea85a509ced327a6f3dd
- SHA512 77c5e374005a782c442b1995acc20974bca015c0073e52d897753ea1783b48cdae9ca92deae2614f1165237e75d9d934c0db81a8b025e7d316c90155e09f03f5
- SSDEEP 1536:U5/cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEL:C3Qw/xLANk0mUW5GmRntSFCjEENl
- TLSH T1709312BA5E2A4AE795BE46D1765E340ACD12130D719FA8CC72A8539C21D41CD2F73E33
- MD5 SHA1 SHA512 SSDEEP TLSH