Overview
overview
8Static
static
5Xeno-v1.3....re.dll
windows10-2004-x64
1Xeno-v1.3....re.dll
windows11-21h2-x64
1Xeno-v1.3....ms.dll
windows10-2004-x64
1Xeno-v1.3....ms.dll
windows11-21h2-x64
1Xeno-v1.3....pf.dll
windows10-2004-x64
1Xeno-v1.3....pf.dll
windows11-21h2-x64
1Xeno-v1.3....on.dll
windows10-2004-x64
1Xeno-v1.3....on.dll
windows11-21h2-x64
1Xeno-v1.3....er.dll
windows10-2004-x64
1Xeno-v1.3.40/Xeno.dll
windows10-2004-x64
1Xeno-v1.3.40/Xeno.dll
windows11-21h2-x64
1Xeno-v1.3.40/Xeno.exe
windows10-2004-x64
8Xeno-v1.3.40/Xeno.exe
windows11-21h2-x64
8Xeno-v1.3....UI.exe
windows10-2004-x64
1Xeno-v1.3....UI.exe
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows11-21h2-x64
1Xeno-v1.3....x.html
windows10-2004-x64
6Xeno-v1.3....x.html
windows11-21h2-x64
6Xeno-v1.3....ain.js
windows10-2004-x64
3Xeno-v1.3....ain.js
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 19:42
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Core.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.40/Newtonsoft.Json.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.40/Newtonsoft.Json.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.40/WebView2Loader.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.40/Xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.40/Xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.40/Xeno.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.40/Xeno.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.40/XenoUI.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.40/XenoUI.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.40/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.40/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.40/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.40/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.40/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.40/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.40/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.40/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.40/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.40/api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.40/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.40/concrt140.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.40/concrt140.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.40/editor/index.html
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.40/editor/index.html
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.40/editor/vs/base/worker/workerMain.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.40/editor/vs/base/worker/workerMain.js
Resource
win11-20250610-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target Xeno-v1.3.40/editor/index.html
- Size 164KB
- Sample260511-ye16kahs91
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 5 raw.githubusercontent.com 11 raw.githubusercontent.com 19 raw.githubusercontent.com - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1132 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230022450464078" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4212 chrome.exe 4212 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe Token: SeShutdownPrivilege 4740 chrome.exe Token: SeCreatePagefilePrivilege 4740 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe 4740 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4740 wrote to memory of 3784 4740 chrome.exe 86 PID 4740 wrote to memory of 2072 4740 chrome.exe 87 PID 4740 wrote to memory of 2072 4740 chrome.exe 87 PID 4740 wrote to memory of 1132 4740 chrome.exe 88 PID 4740 wrote to memory of 4020 4740 chrome.exe 89 PID 4740 wrote to memory of 4020 4740 chrome.exe 89 PID 4740 wrote to memory of 4608 4740 chrome.exe 91 PID 4740 wrote to memory of 4608 4740 chrome.exe 91 PID 4740 wrote to memory of 3008 4740 chrome.exe 90 PID 4740 wrote to memory of 3008 4740 chrome.exe 90 PID 4740 wrote to memory of 728 4740 chrome.exe 93 PID 4740 wrote to memory of 728 4740 chrome.exe 93 PID 4740 wrote to memory of 216 4740 chrome.exe 95 PID 4740 wrote to memory of 3340 4740 chrome.exe 108 PID 4740 wrote to memory of 4356 4740 chrome.exe 109 PID 4740 wrote to memory of 3408 4740 chrome.exe 110 PID 4740 wrote to memory of 4212 4740 chrome.exe 116
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\editor\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8e160c728,0x7ff8e160c734,0x7ff8e160c7402⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,14847065670885094363,11868654236618084511,262144 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1824 /prefetch:22⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,6351645899156689556,1260325187783156254,524288 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2304 /prefetch:32⤵
- System Time Discovery
PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,64122322719340095,3931033602584087079,524288 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,6523446251557483695,8181362592771130411,2097152 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,145870978830648679,17253406796752580080,2097152 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,17359844008764348739,8956884412263413636,2097152 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4432 /prefetch:22⤵PID:728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,14989110344702566610,9411539174265098468,524288 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5276 /prefetch:82⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,10645815538507577315,11987975059794189042,524288 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5600 /prefetch:82⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,2523067292962268477,5924480090273057822,524288 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,5180522235463173994,9897319426847861866,524288 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5448 /prefetch:82⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4464,i,9725193621528989624,13811119936053712759,262144 --field-trial-handle=1836,i,11570097562393076370,4993344999997649379,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4456 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 0c6052faf354264a006848fbb864b903d3d2e4b793b1aa0a6f7ac6d3739631b2
- MD5 eca493b776027524781235cb15c4ac98
- SHA1 7f3bc05044c13944eefa657c64b50fae1082ea25
- SHA512 b2f9dc37c290ee3de58d63e4a14a08e2956e4dd342e5fe699753fb882148390bcb580502d71d939f2e4f6afd7e4a639c899c66afa8232753a43c40df40c44917
- TLSH T163E02BD5C915EC3708F927186168174AEB4143162B40849F3B3C920D8FB07364286C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 09db4bde2efaf08a6cf7b4710029ae2330488dc227c9dcf84c69cffd45fbcbfc
- MD5 968a0d719c7fb997530f325a3f32303c
- SHA1 3fa6d25308836ec74ab6a5a054d4cd7d2ac72785
- SHA512 d379ddc798aad13a42e2c4130d61e50ede5081ef8770c7e5391679cd70d0fd891b2e68899fb6d5f1d07ea5ee7120a4fc33e9037b1acbb81db5adcfd7a8bd3808
- TLSH T1BF41BDF793B499BE861192E4DA106E2FCD7D0524032C7CA289E4AE1B53F2973D20139F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7be52ed4bd1dd1b19572f5804377c6bc4ae4952716f7803e3f7011bcc9e5d713
- MD5 ff5bb20e8821caa8306572375b2410f9
- SHA1 ee8902f8cf027e934f719417f07b1228f48774e3
- SHA512 02a27418001a008895f64f12356560569f0648447e0205cdbb21ba376b3ecac2d28ef8fd5c5243bd2274ccfb6d9c7d3377b81d621469e0c7bfd79da777be8a95
- SSDEEP 192:7RBvv/hjpIlUG+xgv7ZpIpAPRp22j9wHsb+WNnenPdSq283aUN5MqVyIsnAUge:7RBv39aav8EUXXOwyP52AaI5Mqe
- TLSH T18842B52DAA50783BACDBD31AF9217757DBF5102124942E88E7FCCA2C14E75CD621741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 7085bd26a00ea25f436317507845db76624f1e305c5ea5c1633f0710fb2525e9
- MD5 6fedf8e0cda28604a18bc21b3b3a9b01
- SHA1 6e736322a4f9228617a8d1dccd80d010032b80ff
- SHA512 7c43690cde2a8678a5465e416e0cead981d993013a68eccf60d0f0f8520df5a31229546fee29023f6dada5f06f5e8901b2628e5ccb2a58fa5dcaf82771739eca
- SSDEEP 384:UO62joO6z7KxkXqKf/pUZNCgVLH2HfgslBr7pLuLcifKO6/XODoO6P+ErU3f6HGy:UO62oO6z7KxkXqKf/pUZNCgVLH2Hfgsr
- TLSH T18972E9676C4C9E770F94CACCD816BE4FADB5010B65D9886843FA982903D4BDB11462FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 af07ea65c659976358a93a2067e5e5a223302a88cc32256a1c6aedc86ade058f
- MD5 a6dd4729a8e57edcdbc893f256e06b99
- SHA1 8a9047e487dc0c9f42ab231a420ea07daf5fb779
- SHA512 e38a72ac4cdf4e1b3612ed4fbe94118775cb1b9696befc2ca22fb638d11a74f23a3fee4a2b47cb13bfddc6d4b05320c3093bc0da66ee2edd5967d5d18b219c51
- TLSH T1D2B0121188015901C84F02B0159254CC35146F50C705330593E06971E83ABA140A5150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588a97.TMP
- Size 96B
- SHA256 637786a689fa29c62cbc0d1505b01595f264556d3cf8900dcf4cb92704acb42b
- MD5 5cb1e4965595a4d5011d3d5096d613aa
- SHA1 1654ea7a45f42951c56c2ec2079250f1ca9a422e
- SHA512 c2c7c31ed46c835e33029624bd720a7a6cd02f3942020e7f327fe55ef38befc536493fba75e126b63816a2ad20cbe35dc7ec6847c4f2d232623c66f7535b3562
- TLSH T1CEB002A9C5066212D4420BF169F9A9D87160DF25CB071213E6E05A67DC367715A6D260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 9337664245451990dd6b19f6bbbcde26885b50a18219fa1f21335e00c9b2062b
- MD5 7f2c9682225252566bf7eb8155965c8b
- SHA1 030199e6993cf3367b4cc76aba1ec17f2cfd6bc4
- SHA512 28336c20e32f923832c2cad6c1bc8bcb3e138240c945e28c66edfd17b0d6dc2e2883b8711b696de59629ce5771bebb6f79294c6d8f948a9bd19bf5139107febd
- SSDEEP 1536:W6mcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE+:I3Qw/xLANk0mUW5GmRntSFCjEEN4
- TLSH T1A89312BA9E165AF795BE46D1729E790ACE12230D309F69CC729C538C21C41C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 d0e2618255a5ee78a42ccee0027c3c9f4092c86d08d8a579bda41e381ac75364
- MD5 1d207d8103c8565382ae33e104d84956
- SHA1 c34e2e1b36729ddc5facd243902776f0fc4e54c8
- SHA512 ee2903ce99ab8e9e4b9e30d197f4038d8008c0368500b635f701f82c9ab98d339bcb36819af998262fa2e6bcefb65ca5babc6cefdb8e7f4cd55bd3d0060e423c
- SSDEEP 1536:YhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3u:i3Qw/xLANk0mUW5GmRntSFCjEEN4
- TLSH T1D39302BA8E174AEB957D4A8176AE7909CE12230D70AFA9CC315C538C21D41C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 47174df20a593d00ab2872a22865ab7b53a8954c0462d684a8afd6b98adc83dd
- MD5 e42e8ed13fad8902d8a4b973413c513e
- SHA1 97effa81cd08e1e5731036133582a1e96fe568e9
- SHA512 d56ffce3a4449a9c6b94d899debd99eb03968405d802ea64b0305963cb0522a82a5e9cb42b3d36c9e51f3aa0b6d313b4f9154353843c1b550efeb7cec546ed26
- SSDEEP 1536:h6mcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE+:d3Qw/xLANk0mUW5GmRntSFCjEEN4
- TLSH T15A9302BA9E164AF795BE46D1729E790ACE12230D309F69CC729C538C21C41C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 cddd5ac2aae3c98da60e71db4f221ab8fa1fd92a5fa4129bbd8338e4a7f5712b
- MD5 db5ad156153b63bc309d559a7cbd7d32
- SHA1 2567b7525979381488d8a8392cf6f517bf9657ad
- SHA512 afdc15608b66fab8d7624e40aa629df11ef6da936492112bb0d6abdc8567c63e8fd765c5d26c166c08581d5218e58b3ff7349d51761c734ce4e1b1d28f32b08f
- SSDEEP 1536:hqXIcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YJ:oY3Qw/xLANk0mUW5GmRntSFCjEEN4
- TLSH T1439302BA9E164AF795BE96C1729E390ACE12230D70AF798C715C538C21D41C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH