Overview
overview
8Static
static
3Xeno-v1.3....re.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....ms.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....pf.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....on.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....er.dll
windows10-ltsc_2021-x64
1Xeno-v1.3.30/Xeno.dll
windows10-ltsc_2021-x64
1Xeno-v1.3.30/Xeno.exe
windows10-ltsc_2021-x64
8Xeno-v1.3....UI.exe
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....-0.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....40.dll
windows10-ltsc_2021-x64
1Xeno-v1.3....x.html
windows10-ltsc_2021-x64
6Xeno-v1.3....ain.js
windows10-ltsc_2021-x64
3Xeno-v1.3....lua.js
windows10-ltsc_2021-x64
3Xeno-v1.3....ain.js
windows10-ltsc_2021-x64
3Xeno-v1.3.....de.js
windows10-ltsc_2021-x64
3Xeno-v1.3.....es.js
windows10-ltsc_2021-x64
3Xeno-v1.3.....fr.js
windows10-ltsc_2021-x64
3Xeno-v1.3.....it.js
windows10-ltsc_2021-x64
3Xeno-v1.3.....ja.js
windows10-ltsc_2021-x64
3Xeno-v1.3....nls.js
windows10-ltsc_2021-x64
3Xeno-v1.3.....ko.js
windows10-ltsc_2021-x64
3Xeno-v1.3.....ru.js
windows10-ltsc_2021-x64
3Analysis
- max time kernel
900s - max time network
871s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
21/04/2026, 01:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.30/Microsoft.Web.WebView2.Core.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.30/Microsoft.Web.WebView2.WinForms.dll
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.30/Microsoft.Web.WebView2.Wpf.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.30/Newtonsoft.Json.dll
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.30/WebView2Loader.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.30/Xeno.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.30/Xeno.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
29 signatures
900 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.30/XenoUI.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.30/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.30/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.30/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.30/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.30/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.30/api-ms-win-crt-math-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.30/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.30/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.30/api-ms-win-crt-string-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.30/api-ms-win-crt-time-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.30/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.30/concrt140.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.30/editor/index.html
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
14 signatures
900 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.30/editor/vs/base/worker/workerMain.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.30/editor/vs/basic-languages/lua/lua.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.de.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.es.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.fr.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.it.js
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.ja.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.ko.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.30/editor/vs/editor/editor.main.nls.ru.js
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
General
- Target Xeno-v1.3.30/editor/index.html
- Size 164KB
- Sample260421-cecbjsax61
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 7 raw.githubusercontent.com - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4936 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212103743824854" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 5828 chrome.exe 5828 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe Token: SeShutdownPrivilege 4228 chrome.exe Token: SeCreatePagefilePrivilege 4228 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe 4228 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4228 wrote to memory of 892 4228 chrome.exe 82 PID 4228 wrote to memory of 4772 4228 chrome.exe 83 PID 4228 wrote to memory of 4772 4228 chrome.exe 83 PID 4228 wrote to memory of 4936 4228 chrome.exe 84 PID 4228 wrote to memory of 3212 4228 chrome.exe 86 PID 4228 wrote to memory of 3212 4228 chrome.exe 86 PID 4228 wrote to memory of 4660 4228 chrome.exe 87 PID 4228 wrote to memory of 4660 4228 chrome.exe 87 PID 4228 wrote to memory of 4408 4228 chrome.exe 88 PID 4228 wrote to memory of 4408 4228 chrome.exe 88 PID 4228 wrote to memory of 1332 4228 chrome.exe 89 PID 4228 wrote to memory of 1332 4228 chrome.exe 89 PID 4228 wrote to memory of 1144 4228 chrome.exe 91 PID 4228 wrote to memory of 5712 4228 chrome.exe 101 PID 4228 wrote to memory of 5832 4228 chrome.exe 102 PID 4228 wrote to memory of 2508 4228 chrome.exe 103 PID 4228 wrote to memory of 5828 4228 chrome.exe 104 PID 4228 wrote to memory of 5644 4228 chrome.exe 105 PID 4228 wrote to memory of 5644 4228 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.30\editor\index.html1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffeec98c728,0x7ffeec98c734,0x7ffeec98c7402⤵PID:892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,7710705935575867900,14919128005068481892,262144 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1684 /prefetch:22⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,1359492251697429327,13112077362969407197,524288 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2228 /prefetch:32⤵
- System Time Discovery
PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,218692545081098822,4126937911565402485,524288 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2268 /prefetch:82⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,17894923034905755965,14612396788142277014,2097152 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,3529960689856704305,7292394319594378459,2097152 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,13748805078323448877,1049447969952459771,2097152 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4364 /prefetch:22⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,8344821582622530564,2833303474658018689,524288 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:1144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,17380732420281513121,13334312495395751033,524288 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:5712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,6425427964833717015,15525579785105429106,524288 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,166765060509541124,593772541529838002,524288 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5608 /prefetch:82⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1180,i,1990607697594683881,11760861638013072717,262144 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,15438298624330812599,5217740678170520269,524288 --field-trial-handle=1728,i,11511701013923658447,2734425266386433624,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=844 /prefetch:82⤵PID:5644
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 a3a3fa5cdc12d8d2df46ee84ef703bdc06c6a7323045eb114450197682a59600
- MD5 4690cc0adc7b4aa45f4c3f5f19ab4ae7
- SHA1 773c2cdf4d57724f6ed2fd94dec2b758ae62e36d
- SHA512 5d183fd9eade6aa99ad6fe8850a4c966df0906d68cb98874d8936be2282897c1c86b499d8642a28a21cc2b1c99551ab0f19d6ff568e626a8e60c5e71ac5846ea
- TLSH T152E09BEADD659C3719FD572960604B46E68453272A41894F3B3D860C8FF4B37424AC6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 dc5522752b58becedd3f976959598b1d0e72252656996ffaef7cdb696a861adc
- MD5 951cb982f77209ddf6a3cdbafe602597
- SHA1 f439e582fd18029dbf28dea5b025d4d72bdbab11
- SHA512 8c107d2b6e7d98e22d598b722e870d5b0fd8579c9384465d9fd0c3fefb49b7328c5f45375c51481482e5790921439e51b725c6ec1c1d41dbacea15a13a9695a9
- TLSH T10251E1F783B4957D8A1192F4EB156F2FCE690524031C7CA288E46E1B43F2972D20079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 06f001a6fe6b2bf8c83fd54037a61a8c84e6a0b86b69e7a0481797c0ec18286f
- MD5 fce126acfc0994d09a4e03bbc210ecc2
- SHA1 fcb47c8cd9a800ce7269f2a7b32d978362541a0e
- SHA512 6ae3875c9eb665892f1dd73b1eae37f7350d271bdac8b0c32424289048777e2d929a9837591de4362ad07aea4d04b0a5e0d32943c4a3279c43cf1c3c43bac8eb
- TLSH T18941CFF753B4957E8A1192E4EA156F2FCE690524031C7CA289D46E1B43F2972D20079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 691B
- SHA256 41e03d4c8c4d69316d31ffac75b08b8deab102f7132035c67cd0f556601db112
- MD5 df5351cb87908608e56c02758f1e9ae9
- SHA1 e5219e8d929810eae03d72bd03e821b2f49af7a6
- SHA512 4dd04f532ac8216cbc57d1534b3598703e6a79912550590dd2305d0629db44fd52b2b141488222ee898603e4142dc25d4a3e7dae2fcfdda4cf9728b9be50a487
- TLSH T1D0012BA7E679B477506A09BB2D04780568BE9431418178F4CFB7D27DA0C54F31B02647
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7c304a119ae3b3e34f7dc6258299833543075480a15c4ca44c64ebab8155883e
- MD5 aa5da7d2e61661ecc66834f56df04363
- SHA1 0c7385938aae1897daa6688e323da749addb74cf
- SHA512 e79e8a4d6da4961f6afe5967acfbfb1527b361b4e03b6383ee626cb91c68e9abd4c9802f8c06528f67ec824dbadb9005adbd4988d7013114d5abc68dd00d0fe0
- SSDEEP 192:PR6VfjE6uMv74zpAPRp2oo92dHsb+WNny4PCkYLZ16Fkwa3rF7afiVyIsnAUge:PR6VLaYEzUX+oNwFPLYt16F63rF7a6e
- TLSH T1C542D72EB914693B5CCAC359FD617757D7F9102160981E88FBFC8A2C05D7ACD222702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 c681d9c7a2855b74f3fb09e2b1332d822c9d40eace009366db0656c8077bbfc5
- MD5 aac89dac4f4f0b5af6ecb5ef71e25655
- SHA1 8609bb2a5dcd2b25323fac7f27f5f6526f098914
- SHA512 1e78ed5354072837112296e677ffeb8bb7caccfbec98ee4be9eba1f0651df639c4aab3cfb79293b095b311631c4e42994f70fdbf21af55851d1a9f415b76b813
- SSDEEP 192:PR6VBjE6uMv74zpTPRpboo92dHsb+WNny4P2kYLZ16Fkwa3rF7afNVyIsnAUgE:PR6VZaYEzxXpoNwFP/Yt16F63rF7azE
- TLSH T1C752E82EF910693B5CCAD259F9517B57D7F9102161941E88FBFC8B2C05E7ACD222702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 8f0501913421e4f88b89b06aecce594d47e8e8a013686ed46a5fb6ee49c944a8
- MD5 18e531d76537e2d794977827dab6fac0
- SHA1 554a2938dd7e6a967b07fc05bde64d9de42bf4ee
- SHA512 ebe906f335af5516605442502c2848b1f4fda4f5954e64bec48af85812ba323948f290c093d35f3a7be03766ea8e165fe0ef5dc8bb2620a19b10f1dc3afafa78
- SSDEEP 384:jtjXu7KxkXqKf/pUZNCgVLH2Hfgsli6Hv7pLuLcif5EXODXK+ErU35KHvHGxidSv:jtXu7KxkXqKf/pUZNCgVLH2HfgsA6Hvs
- TLSH T157720A67AC4C9E3B0F94C6CCD8167B4FADB5014B65DDC86943FA482903D5ACB110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 918cf09ebec701ff96f7a85b4d3eb08133ef695c524e8e7dcb2c9c6ffb2b47c6
- MD5 fa0ad8411ebcddeb8889eacf957164f2
- SHA1 42be70a86441fb6b369761f457b1c3c681ec1c02
- SHA512 30abb8f0c3ac1c9bcbca168c501dfeb3184f409a1ca946ea679cb6b0b2850503dc5f95fa491c7eb19e7937051129eb764e8b00c261a00d3b563315778ca212fb
- TLSH T194B0125180139702C05302B211C2548C39146F108706330553F46B75E82A1F28015190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58632a.TMP
- Size 96B
- SHA256 296442d322a5771dc73193d17d5b35abdd0bc634ddeff4cd805611a1f46e2a9f
- MD5 3a864dd3a168dd382044a970745982e3
- SHA1 4ab6c769474b2be19db63b262e709fcc4aabd2d7
- SHA512 b02b712ae4493200b86f6db633359040510f4b9f5182365d2b1c216167948fc6fe64a8ac811d62662d2a4eddf251094777b27db15a859a2a7c4677c188ccc6f5
- TLSH T124B02200C002FB02C08203B020808EC83A20EF20C303020382F00A33CC20232002A820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 e9885fbe5804163a47f87ca0290d23b91d3c4aee707164dcfdf28a289b770f5d
- MD5 8b16ad6702b046c97493d6b23c1f02f5
- SHA1 1b02dae039fc12c4d937f8257432ad557bcecb9e
- SHA512 773e36c4d40dee0a6addcdd341eeb636c0c1460b9f51a265740474af96265f8bfafea27c933107d7c76e76d9194767322c6071bf08805bd841d516467e457f5e
- SSDEEP 1536:webPfMKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPJ:FMDlBshIZZwINsIrS2uJBLpAkLQqJ
- TLSH T1779302BB39AAEC37C4DC5102B53C2D4E2AC4A1EAC91DB53569CA277F41F1BF99243112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 ad76f3350cd6624bc4bea80d12955a0a593ac3f7d2eb236996471790f3dd7665
- MD5 2730c49974bbed3110000c3511395413
- SHA1 69bfa3cbef4db43a97e07900111a8cbcc9f4774e
- SHA512 1791b84f0d5392b5ef2f4cff93227ee0d6a7f671ecbb57f004bbb46dc7aa936f795ef7dbecaba585b8ac914a04a0b1959da386de55ae4c304fca9f355490613f
- SSDEEP 1536:IebPfMKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPJ:NMDlBshIZZwINsIrS2uJBLpAkLQqJ
- TLSH T1359302BB3EA6EC37C4DC5102B52C2D4E2AC4A1EAC91CB53569CA677F41F1BF99203112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 9ee2013c5d115fe8e747e48ac47ea36cb3d6a5204b6f375cfafb772be511d232
- MD5 ec719cde184d3e16b60964833d70c1c4
- SHA1 3d05ac8fd6f6ec92bf61efda81f5044991bb156c
- SHA512 7450c7efe6bb164959cedc441fc04643b4d76dfc3a29e0f1b19d46573e9bc257001ca7e5afa802f0f4277f20e1c867edeaa03c9a46e2c854d3afe74b06a7542c
- SSDEEP 1536:NqGXPUKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPJ:aDlBshIZZwINsIrS2uJBLpAkLQqJ
- TLSH T1309302BB3AA6EC37C49C4102B93C2A4D3BC4F5E9C919B66559CA277F40F1BF99203112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 af3523b7b899749824b595a904f8576ace3d0bef7df0d8323e288dcb82079642
- MD5 07a7bf96a3ddd14abe5bb40c6030f7d0
- SHA1 259829958d86f3a5430b829a6b10c882f5852f92
- SHA512 de7070fe7c16a9bc3f96a286fbdf5eeb51c37ccc484cf2eeb993c5a33de344f0c7204a3dfdcd9ba0272e2d500a0c4146f88ad79462bb269597af1caa8baae1f6
- SSDEEP 1536:VebPTKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPJ:gDlBshIZZwINsIrS2uJBLpAkLQqJ
- TLSH T1BF9302BB3EA6EC33D4EC5102B53C2A4E6AC4B1EAC919B53559CA277F41F1BF95203112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 de69d5427d8a067cc9fd1224c65a48c791edf1a7787002b3ee482dafd1a5845a
- MD5 ca34b865b7bd15382c414f90ef9433db
- SHA1 01fb21991caf025c6c9a702549c0d09f9a84dcd3
- SHA512 28246bd2da86720ee7c106223829e06ec22a3315ce3d24f339e50aa056d29ec4372ff52e5012daf2ae245c57f17544e5cc31ded5df155a48d899ccc525599955
- SSDEEP 1536:IebPTKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPJ:xDlBshIZZwINsIrS2uJBLpAkLQqJ
- TLSH T1BF9302BB3EA6EC33D4DC5102B53C2A4E6AC4B1EAC91DB5355ACA277F41F1BE95203112
- MD5 SHA1 SHA512 SSDEEP TLSH