Overview
overview
7Static
static
3Xeno-v1.3.25b2.exe
windows10-2004-x64
7Xeno-v1.3.25b2.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
3resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260911-fr - resource tags
arch:x64arch:x86image:win10v2004-20260911-frlocale:fr-fros:windows10-2004-x64systemwindows - submitted
13/11/2026, 11:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.25b2.exe
Resource
win10v2004-20260911-fr
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.25b2.exe
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260911-fr
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260911-fr
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260911-fr
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target resources/public/index.html
- Size 383B
- Sample261113-nvcsssay7t
- SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
- MD5 e582b9106fb430459c697d4c5a519c25
- SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
- SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
- TLSH T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4676 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 2764 chrome.exe 2764 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3148 wrote to memory of 3192 3148 chrome.exe 86 PID 3148 wrote to memory of 4632 3148 chrome.exe 88 PID 3148 wrote to memory of 4632 3148 chrome.exe 88 PID 3148 wrote to memory of 4676 3148 chrome.exe 89 PID 3148 wrote to memory of 2984 3148 chrome.exe 90 PID 3148 wrote to memory of 2984 3148 chrome.exe 90 PID 3148 wrote to memory of 3880 3148 chrome.exe 92 PID 3148 wrote to memory of 3884 3148 chrome.exe 93 PID 3148 wrote to memory of 3880 3148 chrome.exe 92 PID 3148 wrote to memory of 3884 3148 chrome.exe 93 PID 3148 wrote to memory of 2164 3148 chrome.exe 94 PID 3148 wrote to memory of 2164 3148 chrome.exe 94 PID 3148 wrote to memory of 2556 3148 chrome.exe 96 PID 3148 wrote to memory of 1080 3148 chrome.exe 102 PID 3148 wrote to memory of 1688 3148 chrome.exe 103 PID 3148 wrote to memory of 4508 3148 chrome.exe 104 PID 3148 wrote to memory of 2764 3148 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x9c,0x104,0x7ffca02bc728,0x7ffca02bc734,0x7ffca02bc7402⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,11493516725062606699,14781215256900815370,262144 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1996 /prefetch:22⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,2060175102332437548,7836506062364834262,524288 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- System Time Discovery
PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,12378126860306440948,18023091491306529027,524288 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2532 /prefetch:82⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,16463089387768358264,11136466780494638612,2097152 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,3678951369267206740,13538718919333009072,2097152 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,16750775587806660090,9326542726395613297,2097152 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4420 /prefetch:22⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,8958605241201559364,16583937713556418584,524288 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,16681248931010038846,10958690104814028988,524288 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5368 /prefetch:82⤵PID:1080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,6478705523231669472,582776246395269554,524288 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:82⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,950230346151035484,9518816076083501740,524288 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5648 /prefetch:82⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5504,i,17127185266211437613,8426008900791523959,262144 --field-trial-handle=2020,i,8370608781309083166,2304879707714986377,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1164
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0ed44ec6-a73a-4731-8265-c55e4059c640.tmp
- Size 131KB
- SHA256 e2b1d2d2164eabe20683bbd7e4d5737c3310c6cd72f861c2a44666cbf1fff204
- MD5 080a523d1cfd117699c039eeef59d355
- SHA1 796ee751a53170393e61a592a5d28b1340b06ebd
- SHA512 4b1e31f66f1e547de0e97a28d075e8cac31a2e5eac3582c15b300453d0ecd4ee92637eb8a00ee7ddeb00aca977b483d2e2f991c8110b13663d8e2b362cfd9570
- SSDEEP 3072:j0+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:j0+hFD+7t56OD9ZfSAppr2
- TLSH T15CD31232AA95D87B8AFD6541F157A300DE62ACED41DE3A0984465F8ED09FD4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\310091b2-e608-4b1f-8af6-044cf1b7275d.tmp
- Size 131KB
- SHA256 c3a4c09e9eac41e11d46c216347ff1ebc11d078d66a90dbc945716283b1244ca
- MD5 f80ac9931d85888fcce5884b170950fc
- SHA1 caccf72099c3f68f202693464acc8dc2f748a6aa
- SHA512 d1987b8b2ecd1a0a9f4f2e17a91a59f3f91109f48408aefafb46ed251c295bc2bcefd77e9db7d5b972312fd7a6b4b56061c81be536ac8250b0bd38131e5fb7e7
- SSDEEP 3072:PI+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:PI+hFD+7t56OD9ZfSAppr2
- TLSH T175D31232A995DC7B89FD6541F1476304DE626CEE81DE3A0984495F8A909FD4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\53f11660-4225-4394-bf34-c73f64cbc585.tmp
- Size 130KB
- SHA256 75f00d4144b63675ed4540c8341e69da0a072eb191ab4f0b27f4e197dad493c3
- MD5 a6e2c86ca4fa0bffb64b833efb6c7b10
- SHA1 7f59bec6e114550f9e33aac3b81598d003e27d9a
- SHA512 a66b07d5a27a38de7c9e4c49536502895d6ed372c32c646086dcfb9587c606ae764bb3e8ac03caa6867bbd991d061901dd20caa70209c2c75fd9836238db810c
- SSDEEP 3072:X+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:X+hFD+7t56OD9ZfSAppr2
- TLSH T1A4D31232AA91D8BBC9BC6541B157A304DE62ACED81DE3A09444A5F8ED09FC4D0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1a72f585-6c23-4bb4-94e1-c364bbf376ea.tmp
- Size 414B
- SHA256 59310701a1643c8537f69cb75dc11452510885cd26b0064c0fe070d0c186a630
- MD5 536a7ec664e291fa097c4036e9f593dc
- SHA1 dd0dd4ba247cb313dd8538fc4e519e7300ffd9dd
- SHA512 d66cfadb7b3dfcd81a58ed39550bca22cfd23d0255f3454c84db6b093f35aa22df1f2524fc9fcdc2c4cd92f7cb7fc9f42c1af23aea210903496c0438c406560e
- TLSH T1ECE0E5AAC922E82718FD0B5910501B4AEB4013562A41494F3A3D81088FF1636029695C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2724edd8-e69a-4117-9f18-1526cdb3f53a.tmp
- Size 17KB
- SHA256 0af6c3f002a1ae30bf7acd7fe19fadbed02f5a3347c747a05e4f4fc5415c46f0
- MD5 05a7e286b08c02b8abeb3cb3dd4b507a
- SHA1 f76122851d9578b2c614024ebe34c58ca1d71adb
- SHA512 a56c9cc5a7a1ae449c67cfc22fa6faf72834a677f5283df26460801a8687e66bb916f2d25b8e0a6148e706de54b550463e7f1af80a4d8fdd6e69a3a6105e2837
- SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLKLcsSZkXODzq+ErU3ynHoQUTZ6un:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7pf
- TLSH T1F17209A7BC489E3B4FE4C59CDC177A4FDDB5024755E9886442FA482903D4BCE11461FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\74d9f630-a4a5-4a4b-bda1-4d00c5465928.tmp
- Size 12KB
- SHA256 83126c06b7c59ca1b936ffa46fb1070b1e4e608a07c44192b4df6e9f47250fc3
- MD5 05c87c222fd9e0d222fef3f39b1dcff5
- SHA1 a31679b8e502053b46e9347733c95478bb88bbb8
- SHA512 d0718733f6aa8e4ea20805c2217296b4eec3ee9347df76cebe668083d5a47473a878b2a986e93efc90f8a88bfd6757c2446a08d4910d738fb919740ecd8545ef
- SSDEEP 192:eRrvmoLH01av7+pAPRp2ii9THsb+WNnDJPW021e+8nva6VyIsnAUge:eRrvU2aUXS9wlP32h8va6e
- TLSH T1BE42952DBA10793B5DEBD629EA217B53D7F5003160942E80E6FD893C15D7ACC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0df652af-acef-46f1-85ce-e063d74d3a8a.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5bcb58b5-d4da-4b41-9077-65a382849e0c.tmp
- Size 1KB
- SHA256 f3a7b634737c25da5213c1cc53a5405c92f27fb2ac01c69ea59e4963dad19962
- MD5 8ed5cd6909941a48a189ffc9405a76b0
- SHA1 1e59cea1adfaeeb3a4098c08a9f031dcbc48ad06
- SHA512 93fd63f16540045531179caae057220c1ae80c6ab6057b27a4c802f574596bcc092bb968e9eb090871c61e57619ae9c67c5abb4908386a670fe82d266967319f
- TLSH T13C419DF793B4897E8A1192E4EB156E1FCE6D0524032C3CA688D46E1B53F2872D10079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 b905c40e031889dc13724cceed24d07c912a9ce47d660fdf18f6fd28e2df1455
- MD5 e4feb3609ddf8bf599fcd25936e8615c
- SHA1 f8273fe96be5cfd42c62c7e2b1840a962343281f
- SHA512 0d7b89d2bb364f0b14eab227a4a776cebe2b5e1ffa02235495f07fff2c8ccdd26a7a963f317c9bc3f833af516797e21d50be2b79b93372b966c8f39c84f3c773
- TLSH T18EB012548842571AC08342F4155014983664FF11E606130541F00E05A83519080AB058
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 35d430414d48e5cb525b593412e46768fc49d532da7205fc28f8d7ed35c513b6
- MD5 17feea1b2afeb9006f3e9f28ae802791
- SHA1 c7180b96e49efd889966fb89409c0cbe939b8050
- SHA512 29448a1dd24cd9bbf0783f8a5d6888f34ad429cb52fe94375e31b33cb2a00060f72a6aaaf9f44c5592f6484c3d0b0a0fae50d70e9e916e291b2dd1318261f992
- TLSH T1B8B0025AC1136212D05203F1299599E8F3A0EF35C643231A93E45EAADD25660CA2E9A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b80b168b-f0b7-4642-968f-e37ef6b02952.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eeaac744-574e-4524-96a0-5b274ccc1e84.tmp
- Size 131KB
- SHA256 42a78a0a7424dcce076f834b95a4e5c3e57b46cfc3e129e6cc85815774c4a298
- MD5 7e9c48030e3c3c2c36241f95ef11aa40
- SHA1 718ca90967b0c508108c0e2ddc282871f559b5ba
- SHA512 6259cd7506c9ecea73f96baf7b0b8a2cd1af205df42380c491f2674ff0c7fac145c074b8d0753c41142922856ad4b0675e89e893599f50a76a818bbcb900d193
- SSDEEP 3072:a0+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:a0+hFD+7t56OD9ZfSAppr2
- TLSH T16BD302326A95D87B8AFD6541F157A300DE62ACED41DE3A0984469F8ED09FD4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH