Overview
overview
6Static
static
3Xeno-v1.3.45.zip
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....40.dll
windows11-21h2-x64
1Xeno-v1.3....x.html
windows11-21h2-x64
6Xeno-v1.3....ain.js
windows11-21h2-x64
3Xeno-v1.3....lua.js
windows11-21h2-x64
3Xeno-v1.3....in.css
windows11-21h2-x64
3Xeno-v1.3....ain.js
windows11-21h2-x64
3Xeno-v1.3.....de.js
windows11-21h2-x64
3Xeno-v1.3.....es.js
windows11-21h2-x64
3Xeno-v1.3.....fr.js
windows11-21h2-x64
3Xeno-v1.3.....it.js
windows11-21h2-x64
3Xeno-v1.3.....ja.js
windows11-21h2-x64
3Xeno-v1.3....nls.js
windows11-21h2-x64
3Xeno-v1.3.....ko.js
windows11-21h2-x64
3Xeno-v1.3.....ru.js
windows11-21h2-x64
3Xeno-v1.3....-cn.js
windows11-21h2-x64
3Xeno-v1.3....-tw.js
windows11-21h2-x64
3Xeno-v1.3....der.js
windows11-21h2-x64
3Xeno-v1.3....64.dll
windows11-21h2-x64
1Xeno-v1.3....rl.dll
windows11-21h2-x64
1Xeno-v1.3....64.dll
windows11-21h2-x64
1Xeno-v1.3....40.dll
windows11-21h2-x64
1Xeno-v1.3...._1.dll
windows11-21h2-x64
1Xeno-v1.3....rt.dll
windows11-21h2-x64
1Xeno-v1.3....se.dll
windows11-21h2-x64
1Xeno-v1.3....40.dll
windows11-21h2-x64
1Xeno-v1.3...._1.dll
windows11-21h2-x64
1Xeno-v1.3....b1.dll
windows11-21h2-x64
1Analysis
- max time kernel
43s - max time network
35s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/06/2026, 21:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.45.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.40/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.40/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.40/api-ms-win-crt-time-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.40/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.40/concrt140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.40/editor/index.html
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.40/editor/vs/base/worker/workerMain.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.40/editor/vs/basic-languages/lua/lua.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.css
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.de.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.es.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.fr.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.it.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.ja.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.ko.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.ru.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.zh-cn.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.40/editor/vs/editor/editor.main.nls.zh-tw.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.40/editor/vs/loader.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.40/libcrypto-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.40/libcurl.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.40/libssl-3-x64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.40/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.40/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.40/msvcrt.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.40/ucrtbase.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.40/vcruntime140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.40/vcruntime140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.40/zlib1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target Xeno-v1.3.40/editor/index.html
- Size 164KB
- Sample260623-1fklbagw21
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 3 raw.githubusercontent.com - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3636 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267242072434439" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1680 wrote to memory of 3368 1680 chrome.exe 81 PID 1680 wrote to memory of 3636 1680 chrome.exe 82 PID 1680 wrote to memory of 4136 1680 chrome.exe 83 PID 1680 wrote to memory of 4136 1680 chrome.exe 83 PID 1680 wrote to memory of 2916 1680 chrome.exe 85 PID 1680 wrote to memory of 2916 1680 chrome.exe 85 PID 1680 wrote to memory of 4424 1680 chrome.exe 86 PID 1680 wrote to memory of 4424 1680 chrome.exe 86 PID 1680 wrote to memory of 1044 1680 chrome.exe 87 PID 1680 wrote to memory of 1044 1680 chrome.exe 87 PID 1680 wrote to memory of 1532 1680 chrome.exe 89 PID 1680 wrote to memory of 1532 1680 chrome.exe 89 PID 1680 wrote to memory of 968 1680 chrome.exe 90 PID 1680 wrote to memory of 4288 1680 chrome.exe 92 PID 1680 wrote to memory of 1592 1680 chrome.exe 93 PID 1680 wrote to memory of 2480 1680 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\editor\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f6eac728,0x7ff8f6eac734,0x7ff8f6eac7402⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,1686653347864523616,3602300868558960929,524288 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:112⤵
- System Time Discovery
PID:3636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,2779574503980921522,8237117724109484716,262144 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:22⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,8460969458959476518,1572455593363046340,524288 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:132⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,6871266982370253151,14919432519996386371,2097152 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,14584720193638983101,9922044272382130994,2097152 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,13965880554302823412,3165030638332455855,2097152 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:92⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,7006951778006630879,15957299987863021590,524288 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5224 /prefetch:142⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,2061857050340472008,15492427124963326274,524288 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:142⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,6091335181273478747,3954812410496364831,524288 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5360 /prefetch:142⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,1758751273999875553,12138823893200717967,524288 --field-trial-handle=1972,i,17602615627438402032,18206834218919653444,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:142⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 5601ed4e7f376278abd9c1eab1a6ec1a2911bf61f719e5df618333ce60980d86
- MD5 4a93835f36310f3a93f6695dd278f909
- SHA1 1bf223c82c4c75f27196bad38409978e505f1b78
- SHA512 980f4198fb8247ddcbdde0ea529032bb50a47e2fa4614825f8e2647061251a2298e0b8eac16396eeb4305b1a4d8572a865135405074197ffd635d000c7d332f0
- TLSH T1AEE02BABCA119C3B1CFC471864444A87DF4013A727504A4F3B3D420D8FB36764585D1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 57362c80204ceb4a897a9ab270a67a55606cf5c54cafe19135a1d2eca4af604f
- MD5 965fb4288058f64bbc0db46ce1bbfd8f
- SHA1 20f0afeb90cf2101434d79ad148323b10f148c3c
- SHA512 052d97a42511c83b5cd4af6281a72a72dd40b3e628f946b36e3bfec141ab3176e9dea6bbbe7f00e1bbc72cbdd9c46c90c3c94b01425e706826946a7871d7b15d
- SSDEEP 192:NRi517L0CdOv7sBpAPRp2to9NHsb+WNnRuP7we34ahVyIsnAUge:NRiPvVq8UX5rwcPaaHe
- TLSH T1B142E86FBA1025776CDBC22AFA257753E7F9202131D41E84E6FC891C19E79CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
- MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
- SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
- SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
- SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
- TLSH T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 17fa94d3517c2e58b6377de15d3560dab4248d09a2e6dfa9231b7dc35dc222b2
- MD5 63e8e25d2f94a3f5831a7a4dd36759cf
- SHA1 81d9757ac4f1469f0cc9bf21af5b5dec6fe304ba
- SHA512 a22c381be27736c9ff70edd1f8b0fb37b2cb94b42cb9155abf5429c217be60c9c7a253cc42a6f8d5e2e0385b3308ba9cda1baf2c1ce4f3d1dc87c1560756fcce
- TLSH T146B01252C401A251C05203F01192349C7224AF1A970B170943F57D33C8261738014160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5880c4.TMP
- Size 96B
- SHA256 86bbaa3e95db18e6fcc35ac9089cc74c6f73c4a82b00d7eb2a21fcf170649f21
- MD5 018531a4b0aa1ac353c1978cc7339709
- SHA1 9f2a7a795eab3121637f6ebef22f2fb408bc598b
- SHA512 c993d95a7b382bcdf27f8a23c1dc8e0e9d05c8895b4cd9474d3f7a30835601dd47ab52eb539d27b1a6cc44acf5af0eb3adc9dcbbf05a41aed51222b03fa7ccd0
- TLSH T190B00255C2126662C04203F025E9A9D8B2A0EF29C603323296F19A66DC65A73A52D1A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 09a870b9250cbc1d39a69e3d50c52ea8001dd08ec016ad1b134b25f4a07a5784
- MD5 674126ca72f9d69fdc5f2ef9f8f838c5
- SHA1 0bc77c9c821984306cbf536f1a52ccfbc0671a35
- SHA512 9c35ff6cfdd89ea12ec82f16dde20148bb8dfd1e913c7ad8c9a722cf6773378815b7fada77c82997f6cfe59e26054cbf94b17b85c1606afb22f214ca64327f3d
- SSDEEP 3072:ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Ym7Rkm1tYpBeh2BAoe
- TLSH T1DCC312375DB4A83759B5BB1EB04E0B1F1EF14EA7D920DE92C8D85B0427EABCC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b974f9eaa4a723b41b44808a9535439dcf59c7b139803f63288fc4de8ace9c57
- MD5 443ef886d4005f4bb15f4035ac5f259f
- SHA1 597b6948d2620c7823813a5274004007425f3f25
- SHA512 5c1fd9c6f1ae390d2752a4bf5ae87617f0505b0371ddbeb14300241914a0f71de739a07096043db3f914f81e96c13450bab6c8ac782fd624ba8748ffa791f4b8
- SSDEEP 3072:aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:9m7Rkm1tYpBeh2BAoe
- TLSH T1F5C312375DB4A83759B5BB1EB04E0B1F1EF14EA7D920DE92C8D85B0427EABCC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 b6a5f76096d0661d190305141c6893d42e25e6502a4b2524298e0556181d0acc
- MD5 8580b7476b529fe9d02e12365603aa2c
- SHA1 be1bb30255c80d9d8f0cf62b453b240a4df92190
- SHA512 3ddce4518dc967a88a246577ff21947f291b593b45ed7cc03d5b4f6e636c44582e851f1d89561ebc1aaccfb1df6acc2d614056a39bae982a7c9d3583cc07833f
- SSDEEP 3072:wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:7m7Rkm1tYpBeh2BAoe
- TLSH T163C3122B5E75A97759B5A70EB08E0B1F1EF14EA6C920DE82C8D85B0437E97CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH