Overview
overview
8Static
static
3Xeno-v1.3....re.dll
windows11-21h2-x64
1Xeno-v1.3....ms.dll
windows11-21h2-x64
1Xeno-v1.3....pf.dll
windows11-21h2-x64
1Xeno-v1.3....on.dll
windows11-21h2-x64
1Xeno-v1.3....er.dll
windows11-21h2-x64
1Xeno-v1.3.60/Xeno.dll
windows11-21h2-x64
1Xeno-v1.3.60/Xeno.exe
windows11-21h2-x64
8Xeno-v1.3....UI.exe
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....-0.dll
windows11-21h2-x64
1Xeno-v1.3....40.dll
windows11-21h2-x64
1Xeno-v1.3....x.html
windows11-21h2-x64
6Xeno-v1.3....ain.js
windows11-21h2-x64
3Xeno-v1.3....lua.js
windows11-21h2-x64
3Xeno-v1.3....ain.js
windows11-21h2-x64
3Xeno-v1.3.....de.js
windows11-21h2-x64
3Xeno-v1.3.....es.js
windows11-21h2-x64
3Xeno-v1.3.....fr.js
windows11-21h2-x64
3Xeno-v1.3.....it.js
windows11-21h2-x64
3Xeno-v1.3.....ja.js
windows11-21h2-x64
3Xeno-v1.3....nls.js
windows11-21h2-x64
3Xeno-v1.3.....ko.js
windows11-21h2-x64
3Xeno-v1.3.....ru.js
windows11-21h2-x64
3Analysis
- max time kernel
299s - max time network
299s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/09/2026, 19:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.60/Microsoft.Web.WebView2.Core.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.60/Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Xeno-v1.3.60/Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Xeno-v1.3.60/Newtonsoft.Json.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
Xeno-v1.3.60/WebView2Loader.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
Xeno-v1.3.60/Xeno.dll
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
Xeno-v1.3.60/Xeno.exe
Resource
win11-20260911-en
windows11-21h2-x64
11 signatures
300 seconds
Behavioral task
behavioral8
Sample
Xeno-v1.3.60/XenoUI.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
Xeno-v1.3.60/api-ms-win-crt-convert-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Xeno-v1.3.60/api-ms-win-crt-environment-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
Xeno-v1.3.60/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
Xeno-v1.3.60/api-ms-win-crt-heap-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Xeno-v1.3.60/api-ms-win-crt-locale-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
Xeno-v1.3.60/api-ms-win-crt-math-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Xeno-v1.3.60/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Xeno-v1.3.60/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Xeno-v1.3.60/api-ms-win-crt-string-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Xeno-v1.3.60/api-ms-win-crt-time-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Xeno-v1.3.60/api-ms-win-crt-utility-l1-1-0.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
Xeno-v1.3.60/concrt140.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
Xeno-v1.3.60/editor/index.html
Resource
win11-20260911-en
windows11-21h2-x64
11 signatures
300 seconds
Behavioral task
behavioral22
Sample
Xeno-v1.3.60/editor/vs/base/worker/workerMain.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral23
Sample
Xeno-v1.3.60/editor/vs/basic-languages/lua/lua.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral25
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.de.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral26
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.es.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral27
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.fr.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral28
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.it.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral29
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.ja.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral30
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral31
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.ko.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral32
Sample
Xeno-v1.3.60/editor/vs/editor/editor.main.nls.ru.js
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
General
- Target Xeno-v1.3.60/editor/index.html
- Size 164KB
- Sample260930-yeacvashnd
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 4 raw.githubusercontent.com - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3960 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 2592 chrome.exe 2592 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe Token: SeShutdownPrivilege 5380 chrome.exe Token: SeCreatePagefilePrivilege 5380 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe 5380 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5380 wrote to memory of 2632 5380 chrome.exe 80 PID 5380 wrote to memory of 488 5380 chrome.exe 81 PID 5380 wrote to memory of 3960 5380 chrome.exe 82 PID 5380 wrote to memory of 488 5380 chrome.exe 81 PID 5380 wrote to memory of 3348 5380 chrome.exe 84 PID 5380 wrote to memory of 3348 5380 chrome.exe 84 PID 5380 wrote to memory of 1156 5380 chrome.exe 85 PID 5380 wrote to memory of 4276 5380 chrome.exe 86 PID 5380 wrote to memory of 1156 5380 chrome.exe 85 PID 5380 wrote to memory of 4276 5380 chrome.exe 86 PID 5380 wrote to memory of 5012 5380 chrome.exe 87 PID 5380 wrote to memory of 5012 5380 chrome.exe 87 PID 5380 wrote to memory of 4384 5380 chrome.exe 89 PID 5380 wrote to memory of 5408 5380 chrome.exe 91 PID 5380 wrote to memory of 804 5380 chrome.exe 92 PID 5380 wrote to memory of 5436 5380 chrome.exe 93 PID 5380 wrote to memory of 2592 5380 chrome.exe 94 PID 5380 wrote to memory of 1632 5380 chrome.exe 95 PID 5380 wrote to memory of 1632 5380 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60\editor\index.html1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaeed9c728,0x7ffaeed9c734,0x7ffaeed9c7402⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,12039353305600643841,9507226852563759633,262144 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,7380063058985559393,1368242554173376842,524288 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2156 /prefetch:112⤵
- System Time Discovery
PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,16488596065059692026,10594888347395857335,524288 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2688 /prefetch:132⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,1051103799265728560,16322813442729682492,2097152 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,15684497810276978257,1530213453961794882,2097152 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,18330646948669333075,8196734496706063221,2097152 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4320 /prefetch:92⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,13023316543507008351,9398610471996064676,524288 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5368 /prefetch:142⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,7920537171980653464,10944605842822399344,524288 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:142⤵PID:5408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,5853199026853190292,11372110251473760671,524288 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5700 /prefetch:142⤵PID:804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,4814430372021010123,14408665226394824201,524288 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5620 /prefetch:142⤵PID:5436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5480,i,9540984853594290978,12679074645611298417,262144 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5548 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,18101893604669983461,11504646088341878548,524288 --field-trial-handle=1980,i,17218106021726955140,1708795922746171337,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5156 /prefetch:142⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 fe0bc73aedcb06b4e17e95c9908dc6dc2210f175a18665328ff15f3746cd1237
- MD5 b1900dfe1138694d5a1adbd331be1c27
- SHA1 0b03d877606aeb3dc74544f18c2f8981ea26ed31
- SHA512 f57cefb8fb43212a96ee82393523da8a88728bb0e5e8000463cb25b097ddf88e98ab117e500ad8b9c656b6164c1ea4b518164eb5fc67b241fade0eceb573286b
- TLSH T1F4F078F6C821AC2B08FC0B1920A50B47E740132B2B40884F3B3DD20D8FB0A3F0695C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 286d84cd4e6baaaf6485a376040b161c6e20b5f4ad440a7a2a58f7c13c8327d8
- MD5 e67ac0f77e031cafb94fb6cf8a3888a3
- SHA1 af574d775c3fcbb66dc8bd20ac9feb96dcf6c8a8
- SHA512 6af45f93aaa5ab8618e118baf0c515b01b3354a4db8bb2448d1ff045ae86fde530e0b934f43e0322b13a2cf6df17382031c44501b2df3a88616637260eb3c848
- TLSH T144516FF7C3D88A7D890156F4AB256E5FCD6D0A14532C3C56C8E4AE1F53E29B1D24068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 46601b7afb1099ad825bdca37934aa512bc1866508fc7cceb65c17f17dddd968
- MD5 679eab29194e96f9766f95bc2dbdbc4f
- SHA1 abf1d926a6516315d8328ab89ba6e0f973884381
- SHA512 0fdf1e3ef1eb5d7b736d49f6ca5b5af6ed635496d70567e6931d1efb8f3931228e4bc60562db32c720afe39fdee76fe709d92aee25563e90e89677e58c194214
- TLSH T175519FF7C3D8863D890156F4AB256E1BCD6D0A14532C3C56C8E4AE1F53E19B1D24068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0f5e4d2552c1197d02f0bb0b667780c1996fd73cb0699e3674168d07362a2268
- MD5 0554de04f11067643f2681e62b3e6e3e
- SHA1 d1cfdfb8ab8552a77b0b4b19391945c21c2369e1
- SHA512 c9bd01190705c716fb3b956faba93c9af931c51cf44d616dff685479f281b1312c86b31a615eab43133777a3230e5f36ff4398aac49e946960c2f58fe834c488
- SSDEEP 192:xRvi6pjw9SSmmv7fpAPRp20M9UHsb+WNn9nPjt2de85+VyIsnAUge:xRviZ9SSmSjUXmWwJPp272e
- TLSH T18442B52EED50787F5CDBD22AF9667763E6F5102620A42E84EAFC893C15D75CC221381B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 86539c1cb934d38c9f0a393149a16aa7c18619e6564b9d93f015f2e4e0f19433
- MD5 daff128755ebb6e526e961c16f159647
- SHA1 c504f1d7e2bfa6bc9f1ac9506936d06ce61daae7
- SHA512 3985d7cdd010fd2b9f8df243999cfbc1538ec5fe0ca81519ad27d5eced794470b5fc401694630ada9863df280c7580e88a5f398f1f284296922d7b5d27844052
- SSDEEP 192:xRvispjw9SSmmv7fpwPRpW0M9UHsb+WNn9nP9t2de8A+VyIsnAUgE:xRvi79SSmSjMXGWwJPf2C2E
- TLSH T1E142B62AAD50787F6CDBD22AF9667B62E7F5102120A42E84E6FC893C15E75CC2217817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 00b1f5e3f2ee15e41635cc5776beecab26489b83cc8da1b01e578cec0f125545
- MD5 4c845b2618eefdd47280df258df1e5fa
- SHA1 90d6142c1453e2f700bea476669cfb9e36befbb6
- SHA512 4f4b1bf9d6b776e477d3ad3578fd52d3bab53a83694fa9eecdba8eabeff22ee1e9679f0c42ddd6998d0b7c0b64c1dbe2a8235c40f3d2f87323a4df5053bd2ddf
- SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLuLceSOPXODU/+ErU36GHGiGTE9t:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7pT
- TLSH T11872FA67AC4C9E3B0F94CACDDC167A4FACB5024B65E9886443FA5C2903D5ADF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 a92097ed6d29961052f67483be88cca142bf3b35c4f12eaca79cf9e5d6d953dd
- MD5 5f06fb08b22215fd37f9b40e8d184d1a
- SHA1 c3dd6022eec6bf80ff059716a2370d2035d88c23
- SHA512 779320c4d3d9ca683a6ede7ae6ec270159e6d54e81c6a59b7d86e9eb6027cebe4aa54db5574f604cb68631defa87dce8cdefb12efc9977895088f13f37384cfe
- TLSH T1A4B0124981423702C00103B0216490B47360CF39D52213954AE00E01D8313504017209
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f76b.TMP
- Size 96B
- SHA256 db0f0ac387cc14f09f54ea2414e51433f58ea52677ae18e9f66cc33db0b46eb2
- MD5 0d4aab82ce8cdb19f417e529cbeb8ff3
- SHA1 8dc68f39008c75dc15e79746dec619f3d44c6cd5
- SHA512 d625a35d9b3aabc2d364a1b1b1eee0cf9dd5cef34e2f0f85250619fe562f1215199c6ccb5b3bc8d3aab57c2f57de33f62c9dc116321185207c2d3f320a085e48
- TLSH T1F5B02202C0032202C082C3B028C080F83220EF30CB032303A2E20BABEC222200030A20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 33daef4a13369adaed1a91199e2debe2ebb205a4c97ade6680cf21b1b455eee5
- MD5 a86289444278aad180053e1ba28876ce
- SHA1 f25bdef8819815d1c979a9b0895fe8e4439aa507
- SHA512 b3d08cf2449c061c6c36ca3662bdbc13547d70f7be3514b9bdb8bcb6da3ce6dbdd4c0e03e166a9cdc7442ed0f4ebdab298976cf7557a851ee8d31bbcf6f25488
- SSDEEP 3072:NjbH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:Nj5t4fLJ0L6nGJxi3bzqapJjP
- TLSH T1E5D312F0D1A06C7ACBF7EE5145756E948EB1D5C689CDBE2409E98D1802CEA344E13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 37ea03259fe8c02aad455de4e67d6936f594a10fe516a0ecf318d542f3c9fbe4
- MD5 b5f2c139b594ad18134808c9ef354880
- SHA1 2e2544952a3260228544a8f4d13cf15d93eea179
- SHA512 da1c893a60d79532e8ff982243dd3f53762eedc07c06dadd0b0c731e47a40453e940811ca2b70ac5f3cf0d765e51cd0004f14b36e4c7809befc24e95a1ae5c61
- SSDEEP 3072:TqdH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:Tqzt4fLJ0L6nGJxi3bzqapJjP
- TLSH T1BFD302F0D1A06C7ACFF7EE4145756E948E72D5C749CDBE2409E98C5802CAA394A13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 b0b7672eb6b07630ea223f373fb813508ad04f7c47d7cda0474c057bf82ab9f5
- MD5 f16ba080688892012afcd4e2318ad9f8
- SHA1 77219013e3bbb72c7d622e158640e1e45006190f
- SHA512 de08306935ace02a923b40c27bf3d7ec15e6bcf78861b6ce015233571710220460f51e51fc4a037419bea816e6b0175db99f19bccc6e1eb0e7ca353f08cafa87
- SSDEEP 3072:cjbH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:cj5t4fLJ0L6nGJxi3bzqapJjP
- TLSH T195D312F0D1A06C7ACBF7EE5145756E908E71D5C689CDBE2409E98D1802CEA384E13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 8c2dae8e20b4067a815ece4bd0045efc7be7cb4d9ae719220cea02d52bc506af
- MD5 dd174c4e884dbcbdd97c7c8124d24c51
- SHA1 415be6cad93d0767c002c242590dd0914f9ff345
- SHA512 a7049e0ba56237f42de737fd82be94981c18cdcfab8b6fe51a2559dbca1afb8114a68cf50748e645a996586d2dafdda3c3fb3f638eb6ab072efee9fc3a75fc21
- SSDEEP 3072:BIH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:BAt4fLJ0L6nGJxi3bzqapJjP
- TLSH T126D312F1D1E0AC7ACBB7EE4145B55E948E71D5C689CDBE2408ED8C1816CEA344E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 7af8d3f084f72dd95a2ef07ac52877ab55761018af33117d8df30ba4ad808f71
- MD5 f4d527cc3a643110b380dd1f0114c717
- SHA1 b2c293698779cf7cafac13538881bdc4d00aae27
- SHA512 8fed14d43ad6dea4dc0f38083e18c3f761db5dba1f71c22ee60fc5a63bb5f75343e96b4452192c6d7f68483a26dacda0bc73e3745f292da504a3c4dd141a4050
- SSDEEP 3072:bqdH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:bqzt4fLJ0L6nGJxi3bzqapJjP
- TLSH T1C4D302F0D1A06C7ACFF7EE4145756E948E72D5C749CDBE2409E98C5802CAA394A13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH