Overview
overview
7Static
static
3Xeno-v1.3.25b2.exe
windows10-2004-x64
7Xeno-v1.3.25b2.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...no.dll
windows10-2004-x64
1resources/...no.dll
windows11-ltsc_2024-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...-0.dll
windows10-2004-x64
1resources/...40.dll
windows10-2004-x64
1resources/...40.dll
windows11-ltsc_2024-x64
1resources/...x.html
windows10-2004-x64
3resources/...x.html
windows11-ltsc_2024-x64
3resources/...64.dll
windows10-2004-x64
1resources/...64.dll
windows11-ltsc_2024-x64
1resources/...rl.dll
windows10-2004-x64
1resources/...rl.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260911-fr - resource tags
arch:x64arch:x86image:win10v2004-20260911-frlocale:fr-fros:windows10-2004-x64systemwindows - submitted
13/11/2026, 11:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.25b2.exe
Resource
win10v2004-20260911-fr
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.25b2.exe
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260911-fr
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20260911-fr
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/public/Xeno.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/public/Xeno.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/public/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
resources/public/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/public/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/public/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/public/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/public/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/public/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/public/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/public/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/public/concrt140.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/public/concrt140.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/public/index.html
Resource
win10v2004-20260911-fr
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/public/index.html
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/public/libcrypto-3-x64.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/public/libcrypto-3-x64.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/public/libcurl.dll
Resource
win10v2004-20260911-fr
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/public/libcurl.dll
Resource
win11ltsc2024-20260911-fr
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 7.9MB
- Sample261113-nvcsssay7t
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3824 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography svchost.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 4476 chrome.exe 4476 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 552 chrome.exe 552 chrome.exe 552 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe Token: SeShutdownPrivilege 552 chrome.exe Token: SeCreatePagefilePrivilege 552 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe 552 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 552 wrote to memory of 3160 552 chrome.exe 81 PID 552 wrote to memory of 4392 552 chrome.exe 82 PID 552 wrote to memory of 4392 552 chrome.exe 82 PID 552 wrote to memory of 3824 552 chrome.exe 83 PID 552 wrote to memory of 2396 552 chrome.exe 84 PID 552 wrote to memory of 2396 552 chrome.exe 84 PID 552 wrote to memory of 4052 552 chrome.exe 86 PID 552 wrote to memory of 4776 552 chrome.exe 87 PID 552 wrote to memory of 4052 552 chrome.exe 86 PID 552 wrote to memory of 4776 552 chrome.exe 87 PID 552 wrote to memory of 3476 552 chrome.exe 88 PID 552 wrote to memory of 3476 552 chrome.exe 88 PID 552 wrote to memory of 4888 552 chrome.exe 93 PID 552 wrote to memory of 1032 552 chrome.exe 102 PID 552 wrote to memory of 4124 552 chrome.exe 103 PID 552 wrote to memory of 3380 552 chrome.exe 104 PID 552 wrote to memory of 4476 552 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab2cec728,0x7ffab2cec734,0x7ffab2cec7402⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,12812903035442386837,13641931970815172690,262144 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,17244920264895627030,3753671239592726382,524288 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- System Time Discovery
PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,16968241905855676153,4844505946587359937,524288 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2544 /prefetch:82⤵PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,14541249729398755556,14762609839616431620,2097152 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,9419642760410342935,4633732032828788018,2097152 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,7612220740845250827,16731065000581345752,2097152 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4288 /prefetch:22⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,7033431212413599948,13983860951133256580,524288 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:82⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,15278604334606725139,10208467052154087293,524288 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:82⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,4419039302932249273,16152944639926259812,524288 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,3277958691739587843,18253959725389534711,524288 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:82⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5240,i,11165607995066501493,11754644949538181295,262144 --field-trial-handle=1992,i,9025663842791187970,9091457320063453146,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5504 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:2456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4a4879ca-776d-4dd4-8ff6-949764c2b9eb.tmp
- Size 131KB
- SHA256 a8c34258f66b6e0c894b14b124450c05b1fe2d54854cdcb889dc737d59eb79f1
- MD5 be42d3b76bbdf47b435a8f243bbac844
- SHA1 2d4d9bac17da1b8915b794429c5f76d0c7b1a125
- SHA512 505d1a6d4c2b9495417a6d366342dd07aab978ceaaa8c3b3ec009cddaf8fe2a192127a121b0f4af5a8433cfa17e6df95e0d46def6ddf278a67d9ff8ea9277c2b
- SSDEEP 3072:aQ+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:aQ+hFD+7t56OD9ZfSApprU
- TLSH T129D31232A994D877C9FD6541F147A304DD6668ED41DE3A0984468F8EA09FD4C07B3E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\58e3d2ce-2cda-4b1d-a490-a474488c74ec.tmp
- Size 131KB
- SHA256 7bbabc40ad2e432e8a0a0a9da10ad6bf8961859056097974db81642b89384e08
- MD5 ac3a0267ca1f694a5971283ae36cfcee
- SHA1 234183db02b34932c60588ce24629327d28adf2d
- SHA512 79e47dbd256ffca88af3579280995d14c672b27a05552073c71eeeb7f7059ff0218cb4fb7976eee71f4b80f232cfdc02e1b11577dae7df6be78ba9a1f9ffd438
- SSDEEP 3072:H+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:H+hFD+7t56OD9ZfSApprU
- TLSH T1A5D31232AA94D8BBCDFD6541B147A300DE6668ED41DE2A09444A5F8EA09FD4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1c0ff7c4-747d-4cd6-9c8f-c1d17792b006.tmp
- Size 17KB
- SHA256 f5d244fc27324b08d933040741103fc358b1c37b31606061d19ffba629cb5cb5
- MD5 f1666b951abe391b3de0a45b8e2502a3
- SHA1 4dba37d99fe53b1f4f91e0bfe60cf3855e927335
- SHA512 b2eaf6a506b06b6e47e6302e54384b75b6aae735cf46f2a17c16713082b4dbe037c1503160e2c1038eaf83811ee6dc51f55f3fa2adaaffd02b1086aed5f3e504
- SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLKLcsSZkXOD/q+ErU3vfHoIS2DQY:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7p1
- TLSH T10A72F9677C489A3B0F94C6C8D8177B4FECB9024B61E9896456FB582503D4BDF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\57b2082d-7c57-434b-9655-b98118aeff17.tmp
- Size 12KB
- SHA256 48a46a4f40e10144a45643f646b5fdcd4f5f6627cf4640f8c1e5d5083792452c
- MD5 4ed38717e9c1cf9671ba10ea1e55b4ee
- SHA1 3a6f7b6206b6933824731ebb36a83bf02014a78a
- SHA512 c548e6b583d66bbba2a44dfe606df5035d0901eb4b7e6b0508ee056b47a719c808c3973ab48c6df3a63ab24cd0d200931c6232bab6b1b08d5e4e9ebbd369c97f
- SSDEEP 192:yRbymr5dJA/c7v7TpAPRp2Rx9WHsb+WNnX8Pe4/HMUkwgadBVyIsnAUge:yRbyOdWUDvUX4UwsPNsUAadne
- TLSH T10A42942DEE10753B5CDBD62AFA167B53E7F9102120D42E48EAFC892C15DB6CC6227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\139773d1-b7a6-42e3-b6b9-395a9ec019f4.tmp
- Size 2KB
- SHA256 7c4c81017f25bc3aab5c8af3d123a9fc5ed23ffe02b692fde9188584f4b557bc
- MD5 bfc7afcc65acec26c2da1b21a7aa161f
- SHA1 12aca5338e781b8c444a98c7bb65dc0fd6638853
- SHA512 f6a26792c3248d261a4c1b3fa69d7d2b09e4543630d4a4069ccfba6edd428ae49365c516f4bd3036d7ecf5c496c750e2f5b794159470ac95689ef8e783f8dc37
- TLSH T18D418BF793A4897E8A0196E4AB156E1FCE690524032C38A689D4AE1B53F2872E10068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ad44eb7d-f01c-4c0d-baec-9f4891de08c7.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 883678ba5b0cca230a5016db2cadc2e7cc2ff80ab569236bed048c094c874a61
- MD5 aaf1f8461a40b81c1fcb281a2fd1f310
- SHA1 8491e819da24acc343e73772321cd21ccab1b054
- SHA512 5b11371776dea5fe130d7044c93689da7eb79abad1e3991ff02733ddfd0c54b1fc738d7f6e9a7754267e3a901f472b4746fe2112bc5775cc799b278fc6e1b6b4
- TLSH T1FCB01248C0416301C01202F4115014C83564DF24AF0D130141F00E469939290C01B098
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 131e753fe68340c99e399f0d75369430bd6ac8f6628955e05b14c41d0e04df12
- MD5 2d5dfac14315996ac5595c1ceefe8fa6
- SHA1 50a800677693393e46ce0355de9d14318282a900
- SHA512 24bc624f1d7b8dcfb1b518ed939bd42a3617bcf1574f9d86dd9f59a16da254e46cf7fc93b5d057a731bcdce00470dc0df6aba9591fc370acc9607bfe61a38948
- TLSH T131B02280C0022302C00283F02C8C80CE3030EF33C30F2302A2E00FBACC202200A200A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b5a7d221-df05-4911-9178-36538722ce35.tmp
- Size 414B
- SHA256 321e3b9b93aaf90b2fc98046181f87a9541abb69583dc875a061a1215922a651
- MD5 b699f56c947eb984d9a38d30f848619a
- SHA1 0f02801aba682b6d860e373a2d70812b70a3b104
- SHA512 1c04acfef55568c1b72e342be80f0424e0b810369347e355b24ec4e70c089d1ce4e75fe29460fcc3e794f0d58cd3065754ab30367f3955fae750797f4e6d114f
- TLSH T1CBE0E569C921AD2709FD171814905682EB90231A2E90954A3B3CC10C8FB5A3E068681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b74ae2c2-b350-42c8-8d67-9feff43a1930.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e6c4ffb2-5c82-4018-a038-11fd34970a90.tmp
- Size 12KB
- SHA256 8464f153d910d3a59e1fc236a0a2150ece9e00a3c2c08f0287d2a208e98ccb2c
- MD5 f0eaea3c2ba57cde5cb45cf23a446511
- SHA1 a314024776963a812e395ae5785b4cb0a0ad1fe9
- SHA512 02d1a7437feb0f7abeb8277aae434d89b90f7c777c2e3fc87b1602b86a2815fde0b5d79263c8539987ed1db0713e855b63f86482e02e69c02231b17950495944
- SSDEEP 192:yRby3r5dJA/c7v7TpAPRp2Rx9WHsb+WNnX8PGK4/HMUkwgaBBVyIsnAUgE:yRbyNdWUDvUX4UwsPusUAaBnE
- TLSH T1A242952DEE10757B5CDBD62AFA127B53E7F9102120D42E48E6FC892C15EB6CC6227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a503fff2-290d-4e1b-a938-470156c3af8a.tmp
- Size 131KB
- SHA256 d49c8dbb46a89f63b79c57dede5e86432976e8f9b63eef4f4a411175f239f024
- MD5 eac9e27dd1487bcae858b779b8cf4bc1
- SHA1 3ad04ce677f07d07459c6167a4f06dfb1b6640dc
- SHA512 801fa8af889aa92dbeda5aeea04601dc55a6601f054fde87c85d148f0f7f7574d28c30727a8d5c602ac5338431da3b17c1ac7219bbb38ce2fdf065743551ce34
- SSDEEP 3072:G+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:G+hFD+7t56OD9ZfSApprU
- TLSH T1B9D31232AA94D8BBCDFD6541B147A300CE6668ED41DE3B09444A5F8EA19FD4C07B3A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a86bdadb-4a64-4524-b75f-b192a2c4485c.tmp
- Size 130KB
- SHA256 d5974768e527c4d02aba272cbf9a36fe58c9c0134e53d59983edb5a8f8a03e1b
- MD5 7e55f6baf09c6cde73e47398e795d337
- SHA1 f0442971619b23b3a3a6aee89c161b0e053fe062
- SHA512 bb7bd92ce820b88cdb562ac86551394f47ded93c89c9b58d5a85d3c14b094dead5e8ab05a89005ca53cec3a0f5e39b204f0e9d76a1b6c6050492a076a1ede00b
- SSDEEP 3072:l+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:l+hFD+7t56OD9ZfSApprU
- TLSH T197D31232AA91D87BC9FD6541B197A300DD666CED41EE2B09444A5F8EE09FD4C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH