da3e1bc7ff90b429f063f44d4490c2558a571acde651afc6f4955df3a1f16c1f

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RuntimeBroker.exe
Size 28.5MB
Sample261030-tekflaeh78
SHA256 da3e1bc7ff90b429f063f44d4490c2558a571acde651afc6f4955df3a1f16c1f
MD5 6ba45524753ab443789f24214853c9d8
SHA1 32f5fb0cf1e0f30d9d174be347a39055d32e20b2
SHA512 e96ff2845182120cec8a65b4e95b80c438940dcf2c13d90e3a50eb2a237a8067b567e39d96789b4cb98cbd89690b414089404f127b5f2ba8698a6bf96f2fae72
SSDEEP 393216:0E9cVXY6XTvEdFwzKb3Dpgmuw1ofKFjO9:05I+vE3wzeO
TLSH
T114672926914E653DE116B1B4D2AACF2BC7F8BC0A5124EE961AC1CD33190F997FF60943
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\Desktop\k3 cracked\k3 cracked\RuntimeBroker.exe	Xenos64.exe

Executes dropped EXE 1 IoCs

pid	Process
2604	Xenos64.exe

Loads dropped DLL 2 IoCs

pid	Process
2604	Xenos64.exe
2604	Xenos64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
60	api.gofile.io
62	api.gofile.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4060	chrome.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = ffffffff	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 5e003100000000005e5d088010004b33435241437e310000460009000400efbe5e5d08805e5d08802e0000000d070000000005000000000000000000000000000000b5627d006b003300200063007200610063006b0065006400000018000000	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\ = "Run"	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 5e003100000000005e5d0d8010004b33435241437e310000460009000400efbe5e5d08805e5d0d802e000000fe6701000000090000000000000000000000000000004bec86006b003300200063007200610063006b0065006400000018000000	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Xenos64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64\ = "XenosProfile64"	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\ = "Xenos 64-bit injection profile"	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run\command\ = "C:\\Users\\Admin\\Desktop\\k3 cracked\\k3 cracked\\Xenos64.exe --run %1"	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\k3 cracked\\k3 cracked\\Xenos64.exe,-135"	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64\Content Type = "Application/xml"	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	Xenos64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\NodeSlot = "4"	Xenos64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run\command	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Xenos64.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Xenos64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xenos64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit\command	Xenos64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit\command\ = "C:\\Users\\Admin\\Desktop\\k3 cracked\\k3 cracked\\Xenos64.exe --load %1"	Xenos64.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1624	7zG.exe
Token: 35	1624	7zG.exe
Token: SeSecurityPrivilege	1624	7zG.exe
Token: SeSecurityPrivilege	1624	7zG.exe
Token: SeDebugPrivilege	2604	Xenos64.exe
Token: SeLoadDriverPrivilege	2604	Xenos64.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1624	7zG.exe
2604	Xenos64.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2604	Xenos64.exe
2604	Xenos64.exe
2604	Xenos64.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffb1abcc728,0x7ffb1abcc734,0x7ffb1abcc740
1⤵
PID:3696

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Executes a file named after a Windows system binary
PID:396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,7027314184228098993,14012034584585758868,262144 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1916 /prefetch:2
1⤵
PID:1256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,4032905465881165390,15928091716136921990,524288 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:3
1⤵
- System Time Discovery
PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,6472137722306351390,2560798967955816544,524288 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2524 /prefetch:8
1⤵
PID:1472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --metrics-shmem-handle=3244,i,108876377191324031,17107120385497762774,2097152 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
1⤵
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --metrics-shmem-handle=3432,i,9924130556191959263,16076873271092745175,2097152 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3464 /prefetch:1
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --metrics-shmem-handle=4544,i,3014251063415349301,3105974628212998221,2097152 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4580 /prefetch:1
1⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,9498081756451383313,9072773494787840344,524288 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4972 /prefetch:8
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,5230268575270036164,2790380386800366981,524288 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:8
1⤵
PID:1664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,17657114460566867429,13509337770567912004,524288 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5760 /prefetch:8
1⤵
PID:1644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,14893114742185850852,9175669565798622039,524288 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5644 /prefetch:8
1⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --metrics-shmem-handle=5824,i,1971333911208773074,10889241935133456250,2097152 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5708 /prefetch:1
1⤵
PID:1988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --metrics-shmem-handle=3628,i,12836617921597887865,6300743051162359651,2097152 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4896 /prefetch:1
1⤵
PID:3948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,7564263903831204343,7605253991222728482,524288 --field-trial-handle=1920,i,4727362748803851633,14722013712516663225,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5976 /prefetch:8
1⤵
PID:2220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2648

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\k3 cracked\" -ad -an -ai#7zMap29103:78:7zEvent2710
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1624

C:\Users\Admin\Desktop\k3 cracked\k3 cracked\Xenos64.exe
"C:\Users\Admin\Desktop\k3 cracked\k3 cracked\Xenos64.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 20KB
SHA256 cfde44d5f86bfd62622253fc8e1090162756b25ccd15fc3d881e1cbae5e374f1
MD5 22cc079b4472dc5fad5e657f343f3d39
SHA1 18a0aa683b6500ff83f84201c6de670a95c8d5bc
SHA512 88a8aaeb830c0bb35eec256c61879ca64ebb7aaa0f844b3c49b3cc2d7ab494bb22a7dc596d33a475ff64d96fa9b94fa9773ee0de3b306153e22964a88c739cb3
SSDEEP 384:j+rGoAr2UOxWfQwypaVjGH7HtDza3Yp1yls/fVcE65REWD1dRiwjH:j+rK6UxypgSbHtDG3NlNfnECfRnH
TLSH
T1F292D104F7560B8955B590AA0F15F4D536DE6C378B0678F9F7D8AE490378432AF85C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 26KB
SHA256 8bae24100d94d7f155a18c49dd4ec762e114c571d020da056e6fd01d0b8c866e
MD5 aff568d24ea6a84160ffa14a0783bd70
SHA1 3933c191ff8f0608d72e5221d04b9e4c351f56f6
SHA512 50fcb97555cf533fd91550d155bd853d8652599965bbb3ec1113086995902c5eb94332174913a30e044f5a08fe85be7330d3e0a8bc50463f5b71ee22caf60561
SSDEEP 768:bjcUIucdIuTV//1Po7n0w8qxoR9vrJqY2zSmzB64yU:/dcrTV/un0ASjVqLzQ4r
TLSH
T1CBC2E1812FF5AD82CDE99BA95437FB87FCC47548653DD6F88E80415EB9A03833704A98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 17KB
SHA256 e3353a5c76505dab79177ee2d2778523edaf012b508f3fca894a9d965206dbe0
MD5 55d9b9a42b170e2bac53a66f5d2452a2
SHA1 8365b4cc389f367a317b80340a4230a9727032c5
SHA512 60c0f474de4fea0546bf334bce0b5b8e9cd82aade1a0d93aa54a5d4cba8b61749c76e356fea69fa4251739d906053202743f3435a52e9278f33127dc2af66357
SSDEEP 384:P+Ky4SMlUswGoM1t6Vb3BtyBU7Vmsll2HLPzbUt5uHB61+hW1:P+1MaJGoM1tEbdJm7zbUtwhQ1
TLSH
T1E872D1F96A0FC4B05EA21481BF855DAC2C219B1C132A08C2A467A0F9595458FEFFF5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32f071db-f908-4600-9cae-321d23c4a504.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\32f071db-f908-4600-9cae-321d23c4a504.tmp
Size 1KB
SHA256 69e3d8f19bcd793e5392864cc746446f0c4a940e401bc486717ae5842c10a750
MD5 02181fd9518240b6bf14bb584b9326af
SHA1 490efe33dc285159cb23aad412a7dfb600087ab2
SHA512 329b42b6d74e861f7a1bdf829c6447c3952d55ba3e69bc16c2c5c2f9a1c48ba541e9d4d6463169d348f517c9ae888e3037fa17b5021b3c5acdf54656eaf97c5f
TLSH
T132219DD7BA7DB87B206E09772E0578063C7AB432025054E5EE57D22EB0C15E31B07462
MD5 SHA1 SHA512 TLSH

Submit Download

4a92bc5a-26c7-4c8c-98cd-755cc907aa59.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4a92bc5a-26c7-4c8c-98cd-755cc907aa59.tmp
Size 3KB
SHA256 827992182b8e9a7b69e4457a86db3f9413f91fd12dedb05eded0ddc9908842e3
MD5 1ae44529c5b02077d914e8825efae7f2
SHA1 d759becba8d79d6372749f32349c80ce02e5e9ad
SHA512 3d38833e73d96213c79c3810c527a10c58742362b65ed80085372379dfdc6ec70b6c689bda87eca6143c0d17df8cef69b9e5eda45e07404b16a41f63a7e4e31c
TLSH
T16471BDF3C3E8957D892156F8AB116E1FCD691924432C3D7689D4AE0B63F2972D20534E
MD5 SHA1 SHA512 TLSH

Submit Download

523122de-9919-4dae-a2f8-55e1dd627508.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\523122de-9919-4dae-a2f8-55e1dd627508.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

841e9c7b-794c-4144-a5b8-45d51a2cd35e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\841e9c7b-794c-4144-a5b8-45d51a2cd35e.tmp
Size 2KB
SHA256 0c477e8f738803ea53cf6d7854c3f9f7959fe85d19f00c397993f735186fdd7a
MD5 4307da15b8b849b81c4ab4deb91eff19
SHA1 2b18a938b5e4c9ef9266e35b6bb4ffa8bac21fe6
SHA512 3b103e888ca66eff46126686ff817421c75019aeb8eb437efba0cf7e91f8fcaac741eb22f89629cf08bfb4bf6f73187f251ddd606bbf64f368b47293a237a348
TLSH
T1F851AAF3C3E4857D891156F4EB11AE1FCE691924432C3C6689D4AE0B53F2972D24538E
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\Desktop\k3 cracked\k3 cracked\RuntimeBroker.exe
Size 28.5MB
SHA256 da3e1bc7ff90b429f063f44d4490c2558a571acde651afc6f4955df3a1f16c1f
MD5 6ba45524753ab443789f24214853c9d8
SHA1 32f5fb0cf1e0f30d9d174be347a39055d32e20b2
SHA512 e96ff2845182120cec8a65b4e95b80c438940dcf2c13d90e3a50eb2a237a8067b567e39d96789b4cb98cbd89690b414089404f127b5f2ba8698a6bf96f2fae72
SSDEEP 393216:0E9cVXY6XTvEdFwzKb3Dpgmuw1ofKFjO9:05I+vE3wzeO
TLSH
T114672926914E653DE116B1B4D2AACF2BC7F8BC0A5124EE961AC1CD33190F997FF60943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xenos64.exe

Path C:\Users\Admin\Desktop\k3 cracked\k3 cracked\Xenos64.exe
Size 1.3MB
SHA256 922163713b973cf8c4ad80f16cf69305ed0ca319b314e7ec8ae1982ed5f2a9ed
MD5 e2be25ec1c860b98ea99a835cc981d28
SHA1 cd0498ef91cd6c7ce9ebf78b3ee43032d65deee2
SHA512 355f1ec630268ae41e5740592697d1e9d6b05001b71a1e8dc29206c59ff59d9cf23200f8755fb9d7ce639d27d0fd03ca1f203da70a652bb9a30587b5a93146a6
SSDEEP 24576:iSBsKAhjPTMl1xPiZvL9IyK4LEaDnmfSVgPCS3tMrMyj3F9hIF1SqY5cbaF:iSBsvPTMlLqR6N4waDWSVE3tMx3FE1Sr
TLSH
T16A556D4A77A841F8D076D175C9A78A56E7B2B8060B3187EF07D0A21A1F77AF05E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hooker.dll

Path C:\Users\Admin\Desktop\k3 cracked\k3 cracked\hooker.dll
Size 414KB
SHA256 985908425c5870378435e0b2364bd86220da32a6ec48d2a001addb5eca40c701
MD5 571e6e34b8630cd08cf113df3ead099c
SHA1 de9e0b2a992ef61a503f65eab94d55f88e495c52
SHA512 20060603cc0e28ce4b0ae7d7cef5f3f6525cb24861b246c8965849638196fddc70724c4d63263e8c946889135f1e2ed789302ff9d29e1c54e5de7bbf5d2b1aa9
SSDEEP 6144:quSA1N5wXpZt2O0gnEsQsM45m843EAygNh583l4R7R9nxGTmzEFxo23nzK/:fSA1VgRQV0JgNh5GeXkTSEFPD
TLSH
T114945AA155828C3AC808C771C7171D6EF27BFE894FB16A976F6728881D72BC8DC35642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads