Overview
overview
6Static
static
3Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows10-2004-x64
1Xeno-v1.3....x.html
windows10-2004-x64
6Xeno-v1.3....ain.js
windows10-2004-x64
3Xeno-v1.3....lua.js
windows10-2004-x64
3Xeno-v1.3....ain.js
windows10-2004-x64
3Xeno-v1.3.....de.js
windows10-2004-x64
3Xeno-v1.3.....es.js
windows10-2004-x64
3Xeno-v1.3.....fr.js
windows10-2004-x64
3Xeno-v1.3.....it.js
windows10-2004-x64
3Xeno-v1.3.....ja.js
windows10-2004-x64
3Xeno-v1.3....nls.js
windows10-2004-x64
3Xeno-v1.3.....ko.js
windows10-2004-x64
3Xeno-v1.3.....ru.js
windows10-2004-x64
3Xeno-v1.3....-cn.js
windows10-2004-x64
3Xeno-v1.3....-tw.js
windows10-2004-x64
3Xeno-v1.3....der.js
windows10-2004-x64
3Xeno-v1.3....64.dll
windows10-2004-x64
1Xeno-v1.3....rl.dll
windows10-2004-x64
1Xeno-v1.3....64.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows10-2004-x64
1Xeno-v1.3...._1.dll
windows10-2004-x64
1Xeno-v1.3....rt.dll
windows10-2004-x64
1Xeno-v1.3....se.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows10-2004-x64
1Xeno-v1.3...._1.dll
windows10-2004-x64
1Xeno-v1.3....b1.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 03:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.55/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.55/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.55/api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.55/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.55/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.55/editor/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.55/editor/vs/base/worker/workerMain.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.55/editor/vs/basic-languages/lua/lua.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.de.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.es.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.fr.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.it.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ja.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ko.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ru.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.zh-cn.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.55/editor/vs/editor/editor.main.nls.zh-tw.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.55/editor/vs/loader.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.55/libcrypto-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.55/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.55/libssl-3-x64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.55/msvcp140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.55/msvcp140_1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.55/msvcrt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.55/ucrtbase.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.55/vcruntime140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.55/vcruntime140_1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.55/zlib1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Xeno-v1.3.55/editor/index.html
- Size 164KB
- Sample260703-ej1wtabs6t
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 9 raw.githubusercontent.com - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1948 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275248067503509" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 3068 chrome.exe 3068 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe Token: SeShutdownPrivilege 4348 chrome.exe Token: SeCreatePagefilePrivilege 4348 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe 4348 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4348 wrote to memory of 4504 4348 chrome.exe 84 PID 4348 wrote to memory of 1852 4348 chrome.exe 85 PID 4348 wrote to memory of 1852 4348 chrome.exe 85 PID 4348 wrote to memory of 1948 4348 chrome.exe 86 PID 4348 wrote to memory of 3792 4348 chrome.exe 88 PID 4348 wrote to memory of 3792 4348 chrome.exe 88 PID 4348 wrote to memory of 2760 4348 chrome.exe 89 PID 4348 wrote to memory of 1976 4348 chrome.exe 90 PID 4348 wrote to memory of 2760 4348 chrome.exe 89 PID 4348 wrote to memory of 1976 4348 chrome.exe 90 PID 4348 wrote to memory of 4208 4348 chrome.exe 91 PID 4348 wrote to memory of 4208 4348 chrome.exe 91 PID 4348 wrote to memory of 4400 4348 chrome.exe 92 PID 4348 wrote to memory of 5024 4348 chrome.exe 106 PID 4348 wrote to memory of 3360 4348 chrome.exe 107 PID 4348 wrote to memory of 3484 4348 chrome.exe 108 PID 4348 wrote to memory of 3068 4348 chrome.exe 117
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\editor\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdd529c728,0x7ffdd529c734,0x7ffdd529c7402⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,9156490387130813822,10027755315273170608,262144 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,7981863508253918119,9444409104070571190,524288 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:32⤵
- System Time Discovery
PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,16480176730965209159,14353295556302305925,524288 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:82⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,17993910967321325780,5260229704701043807,2097152 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,5551891775887183149,244589577492301406,2097152 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,14344017869595438785,15652538865366246765,2097152 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:22⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,3337411275776570535,17692332152847095425,524288 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,7504551252589823789,14194065556208933614,524288 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:82⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,1367251460869846841,8032916287987319961,524288 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:82⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,2452464446643589509,15069817538056177621,524288 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:82⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4444,i,4524678567896189278,4941576951536849724,262144 --field-trial-handle=2012,i,3970359082687616619,13689286962277524133,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 3f75644a23277dbc05d32218f6f31114d5acff74042687742cfd1a99f8a4d137
- MD5 361e9b7994001b91412bf32bc7394e14
- SHA1 f6e33ce829e1b9bf7e88dc409f8f6b606dce5d72
- SHA512 5c71878f302f8d7a46903f69880129e6b674a181f5020195b37d9d2842df89cfdf99f4561626c79f09e250ba3d51da0cdb1b63c73bedfcd2733308ab28e0c8a9
- TLSH T155E02B96CB35AD3729FE071C60914B45EF5513162BC05A5F3A3CC30C8FB963A4586C9C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 a298ca6fcc9260283e622c81728eabdd5a49158627b3f72d4faee3965b5904a7
- MD5 5fd92995acc025a4d14249201b2b7c6e
- SHA1 8f985abd1bd02faef61a654f0235f4fb543e5862
- SHA512 700aaacd0e8f360627c6a150d0ccc22d398aab17465482ce1307fc1a35486df43f7ac96a7606fa238fbe9c4ad8df530fd2e0c528fa1f907b8bcb0c74ed9688b7
- TLSH T184419DF783F4857E8A1596E4EA156E1FCE690524032C7CA689E46E2B53E2972D10078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a328f27d014861d4f83382265ac3a4119981b232d5bc3b14eaa404d462ba93b4
- MD5 56f859f26fa9f0fa9ea79f90e0b86215
- SHA1 7f2b1487adcf5579589f1adf8c8ce6bc396eb43a
- SHA512 3ac5b9f90d2c99a66f082a55e3426f98b74c5fb907c560fc8f650411ed833d14bfdf6c1a87d5259b59365a2abccae0f8d99b250a4e8c5e12e2860cfbc3c3ddbc
- SSDEEP 192:LRnOLDkRIz2v7hpAPRp2Eo95Hsb+WNn+rPO22TW9GJLVyIsnAUge:LRn4o0C9UXyrwCP52TW9wNe
- TLSH T15F42D82EBB10697B5CCBD219F9667B17D7F6103125A02E84E6FC8A6C05EF9CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 975537538bac9ad1696ba50d25afeca549f8ab96e9ad4bd84ac09090e02efe41
- MD5 c068243de985b9097c76a7195caaca97
- SHA1 5d8af19660df955935eae4be48506d527fa01d36
- SHA512 6b0d1ebda5c4be81a53813d679e57b100168034419c7c2aadc8c19c93472e27b0a29075d967345d0ca44ffed67275ffecbca382e74a412369f553ed8755618c2
- SSDEEP 192:LRnOLSkRIz2v7hpAPRp2Eo95Hsb+WNn+rP+22TW9GPLVyIsnAUgE:LRn490C9UXyrwCPJ2TW9+NE
- TLSH T13242D92EBB10697B5CCBD219F9627B07D7F6107125A02E84E6FC8A6C16EF9CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
- MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
- SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
- SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
- SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
- TLSH T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 3c283501a48bf8d7d72c866474648ef75698e4e6e3d1d64b6979b197cf80fb27
- MD5 a487235150942179eefe3bb9d082615d
- SHA1 1d4c14b4a2d82fb55df1e90af00909aa5a797b1f
- SHA512 27b773023e9e635af83dfed891fe0f78cad13db92756ef3c854c5b606aba6e756d279f5dedb0df30fd925e2a642881393f76cd3d9fcc46d5cee877555a60fa1b
- TLSH T1DDB0124280015601C48603B01543188872645F50D60B270143E06A37EC265618424250
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a728.TMP
- Size 96B
- SHA256 354ac59c7bf6d84440bed46319dce47581ad729b2402e5f68886da7d69c04c5c
- MD5 a75bdaee49cde2cf299ef72d49188092
- SHA1 f685451f7614e0352c5313d5bfefc129f26111eb
- SHA512 303bed759aa9e21cb6fb15d6141123e120ca9ffc1bea2e7cf7e2df9a657a979a7ae110dbcffb256eef4fc7e674712335da930c5070529b562743b2f320c4db5f
- TLSH T16FB02200C002B202C80303F02A82E0CC3032CF3CCE03030282E00A2FCC20A32002A2A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 26ff85c3aea1feb2af32b54ed0f6f3915c899a7845966199d4913ce027d30828
- MD5 d4d6481342f02fa46a172a1a79d10d92
- SHA1 51b9c91128cfea0b91822bf3a980084bacd65cb7
- SHA512 250f24022fb00fa7e748021f07191dc9773e3f698c413982bf98321204ebf151e3bbada194e7209c39cee859d83a305ee44387794018c13b9dab2e4c8acb9834
- SSDEEP 1536:lzxyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:9vqfd7NtZL8cHQRZEQ6Sps9
- TLSH T12BC30237EBC21E335DC2DB64B9130FDB57B644999034D301EABD2BAB6893855A48246C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 9be24d1af0ddc9a1ce6717abc3e2abfc00c42db373f667b79a2751ac933df9e9
- MD5 b153d797591e916226fe86ebc4c5f293
- SHA1 fdd80b771c8415b4d3a3fe4a5470ecd5de669c04
- SHA512 20b17af66e86a591735d900ec64b65c0ae172101bfb62fcbdfcb3da82c1b27df116e0466834ccc5ac5ef68443c98faf9595cc2607739eaf10ff11abd10b5b56b
- SSDEEP 1536:wZGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:GMqfd7NtZL8cHQRZEQ6Sps9
- TLSH T1C2C30237ABC21E335DD2CB70B9130FDB97B644A99034D301ABBD2BFB6983855658246C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 a0046c8ee54b8efa87420f2b8c40ee367ef5711866ecb8f9ebcf6e2175789395
- MD5 d0d73c65416f5231b5745d3405157a84
- SHA1 37ef1c1ab889ffc17572907e4893d3b3f1f967a0
- SHA512 ce93d8c17726e505fc3b9d4a1ee960d0fe42637393fd5c8870a90cded201b0e724969d477235f16f1dea2c060325a2da5c40a1a8c5b6a6252fd9841b96c605e6
- SSDEEP 1536:6PyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Uqfd7NtZL8cHQRZEQ6Sps9
- TLSH T1C8C30237EBC21F375D82CB647A534FDA97B644A99030D301AABD3BFB6C93851644249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 9d3dd0bcfc65934d400d41210131f9245d9616c07b5e12beae6127ed8c586047
- MD5 e45b326f6f1ae7c754cd405016db3a37
- SHA1 67e6d54e93678da00bc5543d22f5b1671074a50a
- SHA512 95c72734d7205c3ae1ce23f88446f2e9c38f98bc225fbc07106a48a0d1879fd21c0b87149a6e7fce90753b61efb10d7361d4dbae777b9f991c441024e42504ad
- SSDEEP 1536:lZGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:nMqfd7NtZL8cHQRZEQ6Sps9
- TLSH T1FCC30237ABC21E335DC2CB70B9130FDB97B644A99034D301ABBD2BFB6883855658246C
- MD5 SHA1 SHA512 SSDEEP TLSH