Overview
overview
6Static
static
3Xeno-v1.3....re.dll
windows10-2004-x64
1Xeno-v1.3....re.dll
windows11-ltsc_2024-x64
1Xeno-v1.3....ms.dll
windows10-2004-x64
1Xeno-v1.3....ms.dll
windows11-ltsc_2024-x64
1Xeno-v1.3....pf.dll
windows10-2004-x64
1Xeno-v1.3....pf.dll
windows11-ltsc_2024-x64
1Xeno-v1.3....on.dll
windows10-2004-x64
1Xeno-v1.3....on.dll
windows11-ltsc_2024-x64
1Xeno-v1.3....er.dll
windows10-2004-x64
1Xeno-v1.3.55/Xeno.dll
windows10-2004-x64
1Xeno-v1.3.55/Xeno.dll
windows11-ltsc_2024-x64
1Xeno-v1.3.55/Xeno.exe
windows10-2004-x64
3Xeno-v1.3.55/Xeno.exe
windows11-ltsc_2024-x64
3Xeno-v1.3....UI.exe
windows10-2004-x64
1Xeno-v1.3....UI.exe
windows11-ltsc_2024-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....-0.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows10-2004-x64
1Xeno-v1.3....40.dll
windows11-ltsc_2024-x64
1Xeno-v1.3....x.html
windows10-2004-x64
6Xeno-v1.3....x.html
windows11-ltsc_2024-x64
6Xeno-v1.3....ain.js
windows10-2004-x64
3Xeno-v1.3....ain.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 15:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55/Microsoft.Web.WebView2.Core.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.55/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.55/Microsoft.Web.WebView2.WinForms.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.55/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.55/Microsoft.Web.WebView2.Wpf.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.55/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.55/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.55/WebView2Loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.55/Xeno.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.55/Xeno.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.55/Xeno.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.55/Xeno.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.55/XenoUI.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.55/XenoUI.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.55/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.55/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.55/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.55/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.55/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.55/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.55/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.55/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.55/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.55/api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.55/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.55/concrt140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.55/concrt140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.55/editor/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.55/editor/index.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.55/editor/vs/base/worker/workerMain.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.55/editor/vs/base/worker/workerMain.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Xeno-v1.3.55/editor/index.html
- Size 164KB
- Sample260723-src2lsfj3z
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 3 raw.githubusercontent.com - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1600 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292937342525226" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2172 chrome.exe 2172 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe Token: SeShutdownPrivilege 2616 chrome.exe Token: SeCreatePagefilePrivilege 2616 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe 2616 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2616 wrote to memory of 972 2616 chrome.exe 85 PID 2616 wrote to memory of 2924 2616 chrome.exe 86 PID 2616 wrote to memory of 2924 2616 chrome.exe 86 PID 2616 wrote to memory of 1600 2616 chrome.exe 87 PID 2616 wrote to memory of 2112 2616 chrome.exe 88 PID 2616 wrote to memory of 2112 2616 chrome.exe 88 PID 2616 wrote to memory of 4956 2616 chrome.exe 90 PID 2616 wrote to memory of 4708 2616 chrome.exe 91 PID 2616 wrote to memory of 4956 2616 chrome.exe 90 PID 2616 wrote to memory of 4708 2616 chrome.exe 91 PID 2616 wrote to memory of 4680 2616 chrome.exe 92 PID 2616 wrote to memory of 4680 2616 chrome.exe 92 PID 2616 wrote to memory of 2228 2616 chrome.exe 94 PID 2616 wrote to memory of 1240 2616 chrome.exe 102 PID 2616 wrote to memory of 4020 2616 chrome.exe 103 PID 2616 wrote to memory of 3312 2616 chrome.exe 104 PID 2616 wrote to memory of 2172 2616 chrome.exe 110
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\editor\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb4c70c728,0x7ffb4c70c734,0x7ffb4c70c7402⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,13802428683669921481,11828351937853935422,262144 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:22⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,13458528644803666373,11978129310433469269,524288 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- System Time Discovery
PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,16755039156078664663,4880442287308564645,524288 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,12379442529386493706,9722355571618779847,2097152 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,8240422452869535246,13111469195823441410,2097152 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,15262324691755141605,835107407910021912,2097152 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4144 /prefetch:22⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,10496097450801606529,10381045566090537597,524288 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,7251640403780636800,3346240668210215814,524288 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:82⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,7637225254712280858,7893254859094307683,524288 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:82⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,5799045622427324302,4461242583459477496,524288 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:82⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1076,i,5568760867375267626,16206769080913962529,262144 --field-trial-handle=2020,i,325995613141494033,1876917570914093442,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 f261f9bb0dd300e014f50d528a4f6c1ed3d166df71fc5afa8f2e7d16a89991b0
- MD5 c22380d756ff731bef5d466be3541302
- SHA1 b24a0c29f42351bc84b304da90db0a58f2535fc7
- SHA512 7d88c1093a5aaaca80c2e7c31627ce31dce1569f3b2b1b8bc564b90136241e81dbfb89b7862a5ca70e0ee51e586ef699644127b7b93c07bd6f085559042af86d
- TLSH T19EE02B79D9229C371DFC175875654B06E64113276741984F773D810C4FB473F429685C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6ccbdd34753f2000a7abd7bbab9ae09f96128fa9278677694ea417fabcbf5313
- MD5 be6fe1e2b8668d2652df56fc0522a384
- SHA1 9dac976614a801e6b69084131ccae845e2a3a86b
- SHA512 b67cf6cd0af81795ac234523d82e62d0f30a99ff5c922e298b9e7a62f30c4c765ba8b7bf372dc9fe98380030f64af7802e654b51ac95bfdeaab908275bb83eb5
- SSDEEP 192:FRiv/I5Rjci/v7MF+pAPRp2op09HHsb+WNn2lPHa0ThsVyIsnAUge:FRivERvXgoUXQ1wIP6/e
- TLSH T18542B66EAD112D7B6CCBC229FE62BF53D7F5102121952E84E6FD8A2C15E76CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
- MD5 73285efb9f7ee0bd384426865ccccf8e
- SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
- SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
- TLSH T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 a4656ab1ab59bb054361df2a76fcdeff79bad7b4a5e64cc28faf3a76d07dad93
- MD5 da791dfb30c57aca89dd1807fdf6e23f
- SHA1 5ebf29932722c09a83d3f03a04db4d40d5af2752
- SHA512 59c9a6e7611b4ccc1e812997b8f19fcee2d4f4d221183fa0796ac75dd33c286b62948f967ed75eed937729fad48df10cd7bd94966c6bcd4881468c901d2bbe71
- TLSH T1ECB0120080419102C4520BB41152348873187F12D70E170193E46E62C835161C124050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589371.TMP
- Size 96B
- SHA256 d27c9422adc3ac00eddc60993cbea9c2d699b1208e65780d83a6f5ddd49ba2b9
- MD5 0b05c7e1291b744dbd10b2b22e858f48
- SHA1 3d2ab29ac9d01c992ea2316139b6dc77c13ac3cd
- SHA512 3f6fed5093b5b3797f45b002c820a9d444abf42c985aedad2e945cb4b87830fa466cbf1a42ad70f066c3d0d691e90f3773e9a06fc84f64767dd0bec3121e754d
- TLSH T10AB0222EC0032222C80283B02AB282C83020EF23C2030202B2F00BA2CC302308828030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 bcfa1d4cf23b7cc5c527a5f0227a9cfa70deb96430ca8948660e9823362995e4
- MD5 e2b5b691b3334d1ca50514152fe584e6
- SHA1 54690f59be3efd94307366646dfc220a04201b40
- SHA512 fb66cb85b1bc3463f67fbbf9d17cf84b4d95a19f623c9f3dbe81eede4ccef833ac2fb6f91c1c8be70160ec7c628814ea6405060c398301d1df04f42e4cd194a4
- SSDEEP 3072:/3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/2m7Rkm1tYpBeh2BAoM
- TLSH T1E9C312275E75E8375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b6ec5767b0ed0245b0b078d31451a16093c4c18f028d758baef3313bd46d9836
- MD5 7b8035fb69e83c9a666826f69614d612
- SHA1 8653a551872a14f20001fcf606eba95fbbd79b00
- SHA512 719685fe54706012db72328db81f4efd57320898ee3ba09a332cdbd2c215b995ed7df4b8cc88593f510214ed42c55fee03fffca902206f2551a32a728f6778e5
- SSDEEP 3072:diGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:dVm7Rkm1tYpBeh2BAoM
- TLSH T160C3122B5D75AC3758B9B71EB08E0B1F1EF149A6C930DA92C8D85B0423FA7CC1A49934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 dd62b411a47a1f399bd882ed25b412cf75775c2ae9f1522bfb793fdb64ad2204
- MD5 6f6de87258ba2ad78986301d24edd8f7
- SHA1 a187a9e977f3db37db72349b4b387ae29f67163e
- SHA512 8e63da4cc36dd7489e2ff63d2a8fb826fb8c5e646e765650dad878f844d478d18f5edcdbbe4a8a0432e0d39dd5c9b662e1dd61a2cac88bee3989b98c5635c508
- SSDEEP 3072:uiGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:uVm7Rkm1tYpBeh2BAoM
- TLSH T137C3122B5D75EC3759B5B71EB08E0B1F1EF149A6C930DA92C8D85B0423FA7CC1A49934
- MD5 SHA1 SHA512 SSDEEP TLSH