Overview
overview
8Static
static
5Xeno-v1.3....re.dll
windows10-2004-x64
1Xeno-v1.3....re.dll
windows11-21h2-x64
1Xeno-v1.3....ms.dll
windows10-2004-x64
1Xeno-v1.3....ms.dll
windows11-21h2-x64
1Xeno-v1.3....pf.dll
windows10-2004-x64
1Xeno-v1.3....pf.dll
windows11-21h2-x64
1Xeno-v1.3....on.dll
windows10-2004-x64
1Xeno-v1.3....on.dll
windows11-21h2-x64
1Xeno-v1.3....er.dll
windows10-2004-x64
1Xeno-v1.3.40/Xeno.dll
windows10-2004-x64
1Xeno-v1.3.40/Xeno.dll
windows11-21h2-x64
1Xeno-v1.3.40/Xeno.exe
windows10-2004-x64
8Xeno-v1.3.40/Xeno.exe
windows11-21h2-x64
8Xeno-v1.3....UI.exe
windows10-2004-x64
1Xeno-v1.3....UI.exe
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows11-21h2-x64
1Xeno-v1.3....x.html
windows10-2004-x64
6Xeno-v1.3....x.html
windows11-21h2-x64
6Xeno-v1.3....ain.js
windows10-2004-x64
3Xeno-v1.3....ain.js
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 19:42
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Core.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.40/Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.40/Newtonsoft.Json.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.40/Newtonsoft.Json.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.40/WebView2Loader.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.40/Xeno.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.40/Xeno.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.40/Xeno.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.40/Xeno.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.40/XenoUI.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.40/XenoUI.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.40/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.40/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.40/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.40/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.40/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.40/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.40/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.40/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.40/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.40/api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.40/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.40/concrt140.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.40/concrt140.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.40/editor/index.html
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.40/editor/index.html
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.40/editor/vs/base/worker/workerMain.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.40/editor/vs/base/worker/workerMain.js
Resource
win11-20250610-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target Xeno-v1.3.40/editor/index.html
- Size 164KB
- Sample260511-ye16kahs91
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 2 raw.githubusercontent.com 8 raw.githubusercontent.com 14 raw.githubusercontent.com - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1076 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230022447048553" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 2812 chrome.exe 2812 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe Token: SeShutdownPrivilege 1920 chrome.exe Token: SeCreatePagefilePrivilege 1920 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe 1920 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1316 1920 chrome.exe 79 PID 1920 wrote to memory of 1076 1920 chrome.exe 80 PID 1920 wrote to memory of 4852 1920 chrome.exe 81 PID 1920 wrote to memory of 4852 1920 chrome.exe 81 PID 1920 wrote to memory of 3680 1920 chrome.exe 83 PID 1920 wrote to memory of 3680 1920 chrome.exe 83 PID 1920 wrote to memory of 2172 1920 chrome.exe 84 PID 1920 wrote to memory of 2172 1920 chrome.exe 84 PID 1920 wrote to memory of 5020 1920 chrome.exe 85 PID 1920 wrote to memory of 5020 1920 chrome.exe 85 PID 1920 wrote to memory of 4220 1920 chrome.exe 87 PID 1920 wrote to memory of 4220 1920 chrome.exe 87 PID 1920 wrote to memory of 1996 1920 chrome.exe 88 PID 1920 wrote to memory of 3548 1920 chrome.exe 90 PID 1920 wrote to memory of 5036 1920 chrome.exe 91 PID 1920 wrote to memory of 5288 1920 chrome.exe 92 PID 1920 wrote to memory of 2812 1920 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\editor\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88916c728,0x7ff88916c734,0x7ff88916c7402⤵PID:1316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,15248349661545864240,1152319657749458533,524288 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2092 /prefetch:112⤵
- System Time Discovery
PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,15871652224198532160,4646637430097819744,262144 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,4187700936656796243,14121691458486426497,524288 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2380 /prefetch:132⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,15720115668090099079,17510918297799192069,2097152 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,666916451297871612,6535471168849405745,2097152 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,8846174135219762127,15318923839778250705,2097152 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:92⤵PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,18432783811251272880,8864086981351734213,524288 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5236 /prefetch:142⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,7232387963629462116,3952331991170387872,524288 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:142⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,7497630310488762295,4065505546546446084,524288 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5620 /prefetch:142⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,1519852461529776519,4593030797487012655,524288 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5652 /prefetch:142⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5716,i,5209856783892891354,14148795011008626989,262144 --field-trial-handle=1900,i,4148421989551388262,4322153769756238515,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5556 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2168
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 fe154c10122c7aec7beb68f69a3d6e53021d0dbfb4b743f03cdd4c429150eb7a
- MD5 4040bb9c42510358523408c36e6bea1a
- SHA1 3b4eb1a699e688fe7b3a8642c7db9abdab154df3
- SHA512 3c19e56e926db0a7bf74e7d87107cf8a8c060244d1bed545a5d27f84c24feba5e1591433f1a88dbfe6fc571eb4530ed987e1200f79b6e392a8659ca899426984
- TLSH T1CBE09BD9DA21EC3708FD276961554B46F76113572B40494F3B7C950C4FB092B458A86C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 7b90163bfd6aa6c42186fa96df684491623cfb6111bb9c39c56ee6afe88499a7
- MD5 deb09062dfc654f1e8742e8f916e3c78
- SHA1 c6c3be7281da951b395906f64620a51e7579436d
- SHA512 ab8951170850adfefd140799bf76ad14db93aef91302f6275f790fe8875bfc8e13d551e183ba77b1fd3a6f6ddec158bfe8e1a0bfd045636b87b35f33f59abc43
- TLSH T12941ACF793B49ABE861192E4DA146E2FCD7D0525031C7CA689E4AE1B43F2972D20138F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 b4f11d0c4c121a2f96cf0fb2a57144c0823913b2a6b8074847246c371ec38621
- MD5 5bb6b7c757b4d3ed83ce50e00c9edad6
- SHA1 b7908ec3ad61571daebcda628174382a05ee60f6
- SHA512 62f7f25edb97adca673b4b7ac359ac7b1c86e9f420ce14302194ae1dced7953151e0075979b4b1fde45a35791b6b36de243811a02c743f8d42f2ffabe6830b0a
- SSDEEP 192:2R7xX9RY2v7AptPRpRe7l9qHsb+WNnPCPNu2uIFkwYVyIsnAUgE:2R7x8CsHXQ4w6Pg2uScE
- TLSH T1C852D92EA91429375CCBD329F961BB43E7F5106265941E88E7FCCB2C19E79CD2217027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6f20bfb3eb2ff544d55afb738109ac7c02a0dafb226f2e3b51bf8fec977b8444
- MD5 31baaaf980a0b86ed760da7f049f77c1
- SHA1 5c51aaf3c97352900986dfc92699bcf1a718a234
- SHA512 84451ac308b063cce4d9db31ed833afc07b0f8231496a6d09db16e08fa24e6c928a7ca2c6cca7476b1a160665a4b6d564bbd5ce68c3e080c28d496800f538b0a
- SSDEEP 192:2R7xh9RY2v7ApAPRp2e7l9qHsb+WNnPCPfu2uIFkwWVyIsnAUge:2R7x+CsUXJ4w6PG2uSOe
- TLSH T1BE42E92EAE14293B5CCBD329F9617B43E7F5102165941E84E7FCCA2C15E79DD2227027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
- MD5 e1d791f76039330e35fa0e1827d639ea
- SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
- SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
- SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
- TLSH T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 a45016a760b6280f2e9d764a210a14f132d6de0e1495c40f8264cc832c5e4cf1
- MD5 ceae205d4a6a9240a9cbb2e42f91a7aa
- SHA1 faee59eb1530ff6daf94c9372070f9a6bf6fdffe
- SHA512 9783442945b924f30d41bb8bd4c1e2fa8ba88e2dd7c0296e6fe051bfb3775236deff513b8229819ba85f2cbae6b17ed5c1a227aa775b02fea4ec91a47549d060
- TLSH T154B0125084416911C84302F111C324D831149F1097463303D3E0BAB2D82A1A1811C152
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584188.TMP
- Size 96B
- SHA256 1c8342d4e813e351ecfa037eacb9feda0bd82552c97e13f724bb5e2ffa5e6093
- MD5 f662affc573a1263b2c2ffb1936ebd03
- SHA1 3181787e862c482989ce5c254ba57ac02e9438b1
- SHA512 9db1bcda2eb7ca4878050cf76ba940bfcf712ebf03a730cecc2e213b498c43472a738b807414da89f87221e96941b203ca2d4a4531b3a749fbbf13e78f1f0535
- TLSH T18FB022A0C0022202C0C203B032808FC83220CF22C30302228BE00A2ACC2033000B0028
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 bffe3db0eb3b8f7cfdc222a8a4871cf223a5a54051ae52640582b7d9176f4405
- MD5 8c141db1e2e907903d7faf3a604de1a8
- SHA1 f6f045afb9ab317b2eaef8ce00f2fc13303d29ed
- SHA512 01f2e590fd62db5f507e04dab72da2b76d03dc967fa5455db6f0cf839a80253eb1fc64715291ac91b10e1796bf6b9645b1667fe3bfaf95c2c687c11309270232
- SSDEEP 1536:BJFqP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:e++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1B19302B99D1E7D3523ABD3E6D0079CAC4CE398CE1518557C31C76F0E18AA393A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 55fb341350c3d8431f82f59a93cadab1815453b955278f3ecbc5ccc7c3c5219a
- MD5 0002cf4bed22ac0c12d56ae604346da6
- SHA1 3f6a88de2d5a825609c46e08347e6a97c7ee8d75
- SHA512 23354516879c16495320e5d32ed59e6452b6d7c84e223da730403eb5e0fba1344e1af88aff3e8fdae55f3d486775960f79403e39c2e7605b1a32ba62afe35eaa
- SSDEEP 1536:0JFqP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:F++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1F19302B99D1E7D3523ABD3E6D0079CAC4CE398CE1518557C31C76F0E18AA393A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 bc02620b1d1cccf9ba9c47497371ad6247cf7652480d9dcbda82f358dd6fcad2
- MD5 cea4319542509f9d0c657e1eff1dba47
- SHA1 015e7c79a2d266369c16c669a5a0edc804fc9abd
- SHA512 f7827fea0c1faec0e3ef4f13f1be966f07e9800a680b3b1a3458031e2f2c2c373705b4e33a66c8355e847c3f975c6d572a66615e915d34c7ca3af1099c22ef16
- SSDEEP 1536:hZ+P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:8++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T13D9302B9591E7D39536AC3D6D0079CAC4CD3DCCE1514557C30C7AB1E18BA393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ee69919f-76f9-4b24-8465-6f545853db18.tmp
- Size 91KB
- SHA256 a8b9dc01d100956b777e4878b9188236e8627b64ecb3b12ff3c3cb1f037eb880
- MD5 769fce633f6c545a72e468582064e90f
- SHA1 a9ac2cc9b4286c8e4b567f6116777e2375723b08
- SHA512 e200c88b2d74212f5af9b6224aac50f4f25a18416ad54542d64fbd517e485a55dd21590d1cac9e663acd6c9ce5ba6d5ad43639bbddc38725aff9d307421fb2b2
- SSDEEP 1536:BJLhP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:zJ++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1CC9302B9991E7D7913ABD6E6D0079C9C4CE38CCE1518657C30C7AF0E14BA393A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH