43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/editor/index.html
Size 164KB
Sample260723-src2lsfj3z
SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
MD5 b33eb96a570d0cdf6ded11ff199d0de3
SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
TLSH
T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
7	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5864	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292937350662357"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
4792	chrome.exe
4792	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 1084	3364	chrome.exe	89
PID 3364 wrote to memory of 5864	3364	chrome.exe	90
PID 3364 wrote to memory of 1104	3364	chrome.exe	91
PID 3364 wrote to memory of 1104	3364	chrome.exe	91
PID 3364 wrote to memory of 4160	3364	chrome.exe	93
PID 3364 wrote to memory of 4160	3364	chrome.exe	93
PID 3364 wrote to memory of 352	3364	chrome.exe	94
PID 3364 wrote to memory of 4052	3364	chrome.exe	95
PID 3364 wrote to memory of 4052	3364	chrome.exe	95
PID 3364 wrote to memory of 352	3364	chrome.exe	94
PID 3364 wrote to memory of 956	3364	chrome.exe	96
PID 3364 wrote to memory of 692	3364	chrome.exe	98
PID 3364 wrote to memory of 692	3364	chrome.exe	98
PID 3364 wrote to memory of 3308	3364	chrome.exe	99
PID 3364 wrote to memory of 3308	3364	chrome.exe	99
PID 3364 wrote to memory of 3004	3364	chrome.exe	100
PID 3364 wrote to memory of 3004	3364	chrome.exe	100
PID 3364 wrote to memory of 3140	3364	chrome.exe	103
PID 3364 wrote to memory of 3140	3364	chrome.exe	103
PID 3364 wrote to memory of 5272	3364	chrome.exe	104
PID 3364 wrote to memory of 5272	3364	chrome.exe	104
PID 3364 wrote to memory of 4264	3364	chrome.exe	105
PID 3364 wrote to memory of 3252	3364	chrome.exe	106
PID 3364 wrote to memory of 4264	3364	chrome.exe	105
PID 3364 wrote to memory of 3252	3364	chrome.exe	106
PID 3364 wrote to memory of 4260	3364	chrome.exe	107
PID 3364 wrote to memory of 4260	3364	chrome.exe	107
PID 3364 wrote to memory of 2872	3364	chrome.exe	109
PID 3364 wrote to memory of 4472	3364	chrome.exe	110
PID 3364 wrote to memory of 5692	3364	chrome.exe	111
PID 3364 wrote to memory of 4792	3364	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\editor\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0xe4,0x7ffb8c76c728,0x7ffb8c76c734,0x7ffb8c76c740
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2604022509901897816,16429933797864873144,524288 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,16532171913776458652,18244802686592147293,262144 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,5712063168093281795,16920836477256293873,524288 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,15950495594315365532,330834078919821412,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,13333482115351080940,3529206471707329760,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5136,i,905871452685454,9161037486622214071,524288 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5248,i,9972078046835889823,7957659803823708681,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5272,i,7457027981273220401,9155911462042660914,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5240,i,15056540161747114921,12393758511390054020,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,17525985186010844075,6629165154527020368,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5828,i,12220181815823674938,10837147911523565179,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5932,i,4784720775912923806,2333291967110629761,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5144,i,3147002706181539293,4784809116719271759,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5256,i,1639142078221820949,6918432705560004103,2097152 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,17419635299371811892,18138594840962522385,524288 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,17734961419741341749,16851339823849408231,524288 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,2639777327896695945,2473893024523068962,524288 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5860,i,703579183044794567,17048304057536985346,262144 --field-trial-handle=2040,i,11855282334611608364,10196203283549249572,262144 --variations-seed-version --mojo-platform-channel-handle=800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 337d8f6276db1af37e0cea8668b5fde901c1ce11c1e0a9477a33e21e92380372
MD5 0cacb46f77b78e8e27442c73b0ab9738
SHA1 c2f45b6c345e72ada171e0bc1601991200877c16
SHA512 8c4283ec138944169ac0a72e906079197e5f178d487625c278d9f7fa6dec7b3c54ad325b1b7af88aa00ca599cf576fc579c783a80341062d2ff1dd0c6a2ac177
SSDEEP 192:5BRGraiVv7Qv3PRpyWf9XxHsb+WNnPLPVE/DUkwpVyIsnAUgE:5BRGrLl8HX7fwTPPvE
TLSH
T1D142B92EBD10693B6DCBD229FA557B93D7F5102161E02E84E7FC8A2C15EB5CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a67c60ec-8dbb-48b1-a08c-1705d16aeecc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a67c60ec-8dbb-48b1-a08c-1705d16aeecc.tmp
Size 11KB
SHA256 4801f90756362b4446308265be0b6894c1e08c217e85f33dc17f1c2825f72b50
MD5 0c22beb2d40a809a7a3f2e5fe6eeb882
SHA1 f934532d9bf8cf5b619b64e401316d5f12889e1a
SHA512 308950e0d5d659d775748d50bf90fa638132a26c32bb10393ec132cedc58dd076406ebf65a8763a2e576912d591ba442119bc3bc75da65ac559bf3cd61bc0fbd
SSDEEP 192:5BRGraiVv7QvAPRp2Wf9XxHsb+WNnPLPeE/DUkwpVyIsnAUge:5BRGrLl86XHfwTPCve
TLSH
T17632BA2EBD14693B6DCBC22AFA657793D7F6102121E12E84E7FC8A2C15DB5CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b28bad8762f167366fc548ae3b4dfbd5aa162a46d4b7b8ad355a159fefbaa7f5
MD5 d836d469d571dd912ac8af9e4ed87af6
SHA1 23164584e8155a1fc9ef70c198bb5002bf72e85e
SHA512 e893b8c00a47806e82b6872f894472b22376de2759d9312fa8f5cc39769a249711d2cd3b33b67c317de397f7046632f1f5cc24e832547b206b002248e7bc1c94
SSDEEP 96:RC0d+r2io+TJ/E0f6m934AuMASl8h4otop53icDRB6pGyvn0SvQxwzQdhjm+9ZmJ:RC0ITo+TQ0IRiU2pnBPSIxhhjm+9Z6U6
TLSH
T1F8C13A76A46C5C7755A7E446F1233A47CDB8306BDA51AFA0EAE50F1C01FB0EC2342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e3f31e0c42c8a951e2a20871d7804943c29aea9d5a371a158a6ba78c5b1ffe62
MD5 a84e97038b8811486f917dd782fedea6
SHA1 6afa19a66cfe7e8c05cb90ae9617e44d25771438
SHA512 2cee8400d623ccbb08c30aa6ec9da74839110abfa116318355b1862f96f0ddf97c2b2ecaf184bfe969b67044d2ddda6b4933b4b33fdaabc04207a15923a9d24f
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok53mDRB6nGyvn0b4T8ZybJv4a:xC0ITo+TQ0InDUDQnPPb4T8Zybl
TLSH
T166A10836A0284D774476D44AB1622A43CEB9706BE9B2AFD0EAD90F0D15F70EC1341A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 52c62aa740f9e999b21d9ebe9a7bd5ccea7579e1436d6c161aa3e5ad19fce42b
MD5 16ed2ad85cc920f2eca48815ea9366ee
SHA1 6c2978bb4f9a65b3436ee0731733ef239c25f30a
SHA512 21e6dfd96c5696020a40aafbd4914024b5393b43715451212c7db150fd78de3de865bb4c8bf645142992689a3738239b0b09381abb2080b5b145245f4d22e624
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934AuMASl8h4otop53icDRB6pGyvn0SvQxwzQdhjm+9Z4:Rt0ITo+TQ0IRiU2pnBPSIxhhjm+9Z6U6
TLSH
T112C13976A46C4C7755A7E442F1233A43CDB8306BDA51AFA0EAE50F1C01FB0EC2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download