16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42

Analysis

user interaction
yes
max time kernel
231s
max time network
232s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dism++x64.exe
Size 1.0MB
Sample260809-cy7a2aydpb
SHA256 16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42
MD5 a1a058ff98dc1f9320195b398aa06167
SHA1 d974136e6dc4b1726b50a770ec8d6f0f4fc859a7
SHA512 8517354f8579905a5ff1b581aee79ac4632d83bf1672490b653caf5807e902745ae1df109083ea895ac63f0a106786390d5e769a220dc21af8f8a7a9585dddc8
SSDEEP 12288:KU4qFPGYdX6h867AoanHh8HcMcv1mFwPxEeGzAS3pQYQYa8I1HwJVKC2+RQ:KRqFLqaB88F8SYzAS3dQYa8I1HGbi
TLSH
T1E9355A0633F804DCD5A78179CA128B2FF6B1BA835A21D2CF416586C55F3FA634D2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Dism++x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Dism++x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4124	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307162918681573"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
460	chrome.exe
460	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3604	Dism++x64.exe
Token: SeRestorePrivilege	3604	Dism++x64.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
4608	Dism++x64.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4608	Dism++x64.exe
1684	Dism++x64.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2816	1784	chrome.exe	91
PID 1784 wrote to memory of 1704	1784	chrome.exe	92
PID 1784 wrote to memory of 1704	1784	chrome.exe	92
PID 1784 wrote to memory of 4124	1784	chrome.exe	93
PID 1784 wrote to memory of 3224	1784	chrome.exe	94
PID 1784 wrote to memory of 3224	1784	chrome.exe	94
PID 1784 wrote to memory of 4760	1784	chrome.exe	96
PID 1784 wrote to memory of 4760	1784	chrome.exe	96
PID 1784 wrote to memory of 4756	1784	chrome.exe	97
PID 1784 wrote to memory of 4756	1784	chrome.exe	97
PID 1784 wrote to memory of 388	1784	chrome.exe	98
PID 1784 wrote to memory of 388	1784	chrome.exe	98
PID 1784 wrote to memory of 1052	1784	chrome.exe	99
PID 1784 wrote to memory of 1052	1784	chrome.exe	99
PID 1784 wrote to memory of 4680	1784	chrome.exe	100
PID 1784 wrote to memory of 4680	1784	chrome.exe	100
PID 1784 wrote to memory of 4272	1784	chrome.exe	101
PID 1784 wrote to memory of 4100	1784	chrome.exe	103
PID 1784 wrote to memory of 2616	1784	chrome.exe	104
PID 1784 wrote to memory of 680	1784	chrome.exe	105
PID 1784 wrote to memory of 1300	1784	chrome.exe	112
PID 1784 wrote to memory of 1300	1784	chrome.exe	112
PID 1784 wrote to memory of 4628	1784	chrome.exe	113
PID 1784 wrote to memory of 4628	1784	chrome.exe	113
PID 1784 wrote to memory of 2304	1784	chrome.exe	114
PID 1784 wrote to memory of 460	1784	chrome.exe	117
PID 4608 wrote to memory of 2188	4608	Dism++x64.exe	119

C:\Users\Admin\AppData\Local\Temp\Dism++x64.exe
"C:\Users\Admin\AppData\Local\Temp\Dism++x64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8ae07c728,0x7ff8ae07c734,0x7ff8ae07c740
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,14931248901311682372,17813112210006785304,262144 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,3639240630753824395,9693347650224342695,524288 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,16924450787990213682,1949328714235867707,524288 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,2319198107611038749,1528829625931285677,2097152 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,12194000576619959844,12447791921162271077,2097152 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,8951007418419766566,9660577675605033890,2097152 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4808,i,2525671600317806060,14140671125339113189,2097152 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4912,i,3450935721866312546,6241627530301291314,2097152 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,6333591162321503061,9193014920685999319,524288 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3700,i,7829922531945345680,11013384748430446617,524288 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,13762396397336279739,8033321125427200368,524288 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,1535149277459607535,15701625784365536587,524288 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3692,i,1751309530557294555,14530518377520389659,2097152 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=1084,i,971208392238416541,7365038396409427110,2097152 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,7206374320415783907,11963435052686676283,524288 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6096,i,13320661384047941328,14481634897290010462,262144 --field-trial-handle=1980,i,14212615592854554042,16987506029764175436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2116

C:\Users\Admin\Downloads\Dism++10.1.1002.1B\Dism++x64.exe
"C:\Users\Admin\Downloads\Dism++10.1.1002.1B\Dism++x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\System32\rundll32.exe
  rundll32 "C:\Users\Admin\Downloads\Dism++10.1.1002.1B\Config\amd64\CBSHost.dll",RunCbsHost {76ebcf0a-c874-4545-bce6-c09f77c7ebc5} "C:" "\\?\C:\Windows\Temp\\" 0000000000000200 4
  2⤵
  PID:2188

C:\Users\Admin\Downloads\Dism++10.1.1002.1B\Dism++x64.exe
"C:\Users\Admin\Downloads\Dism++10.1.1002.1B\Dism++x64.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0c56f484bd81c056eb98a089487965611ed6975f1c913dcab4def7cd79535d5f
MD5 ba0e01e51edf74b5f76fc9c5b498ff5a
SHA1 4d07771e1abb97718ec2e338c969266f7e13cb5f
SHA512 18cfd0b27adf4c3c60b4b1e9cda7f6206e083cb8226ecc3ad2a48ef005d6bace4aae655f4e93292d020e27521927fa2271ba13431c85d7784ae1046c6a677128
TLSH
T1A9E02BA9C921AD2B08FD072D64590646E754235F2B41456B3A3DE209CFB977B0596C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 7876b31bf5ec6667c0b1cf0415180b684f4131c86132b07c0ad5a2d4b984f1c7
MD5 0ef393aeaaa8db45ec787606ef406ec2
SHA1 13856bddee6c38fd1d993e88b15b43da51f37e6e
SHA512 72d52aee9a3d80f77f9090d6276a84450c8bd6e172939977d1a873fc18e7dbd473a088adbc6ed537e4ee432af5d238df100a0a1b3000213930cab6e601ebee6c
TLSH
T1A5C0920B84C01115C36E87B102E31001BEA45F51C9B2A9D261919ACEE8336B44522443
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0829a40a9021b2b47321f8dd44b8cd5e64a0b947e38d69c9746c788b67a782a2
MD5 b3484083a8e71f2f1d9fced76c9555b4
SHA1 535bf72b6e2ea33b756c6cbf0ea24be880e96e4c
SHA512 d8f4809fa8f7fa1aaaa2cbc05bc3e7e01f83b972b1c77034172ce0692926f5287313ba030e292118328af5fa7b4771687ea3b45d07ad20e410829cef1ae6a4eb
TLSH
T14F61180CADC98815CB2723F158C598ECFF3085A741BFDE8EC7419CB2A58ABE21040B07
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c124f174f554b70f4633d8c1fe9d241b18f5ed95d9f01ecaa4c778cd184e96ef
MD5 2821cdcc7dcfdf4a57001e01a14ef19e
SHA1 14c1a1d81355208d372833dc5f768a41022730d4
SHA512 b2c9de9fb706b8bb89b0bafc4c972f47500a69cc8196f1e191fc86d9335677626ffc74022800e2ee1ed3e60336b112966cfdf39d197dc7553a8e0bc1d5d92421
TLSH
T172718CF7C3E8D66D891156F49B256F1FCE2D0A28532C3C66C8D8AE5B53E2872D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9d35378210a113b146464e3c0521d1bb87b13f3ed0b15a4810e2c1c717879132
MD5 2b82cbd295bae375e079713e5d6d5a72
SHA1 be72e9fa7dad98be197d6a390f974f0a26c8ad6e
SHA512 d408a51751541c1a1956c5375b164a013472b7ef6220928c190e2004c0df9f406593ff5744e24a147bcc01c40058c5a35efcf16fa4276c9731072c00683cbc48
SSDEEP 192:DDeJxoV4vHETJ2Jm3m4aI/S7/aYoroQdfnsIGImaPoTvdfPnTNPimwmmm7mD0mzX:DDeJxoV4vHETJ2Jm3m4aI/S7/aYoroQv
TLSH
T18412BDF7C3E8852D895156F4AB16AF1ECE2D0A28431C3D6AC8D4BE5B93E2871D21134E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7896d77b4f720b5d375279da5dc9f0284788bbc5984fe15c9bd498f6949dcfd0
MD5 cbda2520e44a6bde2bc9daada370df9e
SHA1 90397b367c657a39936359d8e7b1355ff7c28ebe
SHA512 644d4415af789586799671c5157346a774bf04d142c8f85fb31cc73e3ec133e31c8a3a11fba70b84ea296d3797177f623f6d329381b31a3666511e75264ffa7e
SSDEEP 192:HRTcBzYrCp5EbwyDxv72ymp+PRpRU0s0j95Hsb+WNHULcavom+sKcKJPkwoK3aSM:HRTmzYiEjDhQiX97w0t7UcaIkaSe
TLSH
T17A62E72FE9242A7B9DDBC22AFD127757D7F5102625901D44EAFD8A2C14E76CC231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fedc4979096cba1bcdf62604019182bb04b90f8078852e98473350f4f71d5a4b
MD5 433ed8d098c15810cecd878643eeed39
SHA1 d4c3290b8c6630d6ac4c6e45a0583e4b94399c66
SHA512 a0752eedda5813e4e41b1ca1cf7b39522f36304ba97a24e205fe0f458cdc23892efda68cfb54ee68695ee5602f4decdf5cf255aae93be0836a76732bf7182ca3
SSDEEP 192:HRPgrCp5EbwyDpv72ympAPRp2MBL95Hsb+WNnca48S2QJPkwoK3anVyIsnAUge:HRPgiEjDpQUXX7wRS28IkaBe
TLSH
T1A042D72FA924653B9DDBC21AFD227753D7F5102525941E44FAFC8A2C14E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d1f70b21e3970e5ca17edee2a001a59b80073ca965f026c189e4a84229921756
MD5 86d0e581cbda2436aa25be87de2d2067
SHA1 0b15161574ce07a6b155c40d34a68af5eace0c76
SHA512 a10bf5b827e3d03a85e7ecb1c1b321e9983475d71b636361ef872408e894a2b0b8a838014ccddf6cd8efcf8eab7134d7c0391a1b2875cca5b8401813c6b01b25
SSDEEP 192:HRTcBzgrCp5EbwyDxv72ymp+PRpRMwj95Hsb+WNnca4sKc6JPkwoK3aSVyIsnAUp:HRTmzgiEjDhQiXP7wRucKIkaSe
TLSH
T15B52C62FB91466379DDAC22EFD127B53D7F5102625942E44EAFC8A2C15E76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0a1cef2b3bddcc74a35850e34c9fd880456722e9a5e685436d6262af143569ff
MD5 896f4d363c3b99422ac2591bc60dde3e
SHA1 b01fab1125a7dff10f7713d273d9ec0fd028e3fe
SHA512 6a8066bb797542e25c3fe0fc07abafc18475ec6dab32525d347e4ddbefab2cf3cff6a340e716def33a9f645b834e5a80da6e81f3f65f05a0099e9a101a166aac
TLSH
T1EEB0120180015153C45603B412C254C87554AF11D60A170543F46926C8252B1C025052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597209.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597209.TMP
Size 96B
SHA256 f00067c278bd545e595bffb2127be56428ff00c36b5bf214cccec8870eb87195
MD5 b85fa3731b963699bf9f09375f4366af
SHA1 df32aa5720fef4ca558150e4c73e7a7a0a5a6004
SHA512 f9ee7da7f26160c4c01b08d40a1efe945f363b88dd33ea55a0bac6cb7ec99f82868d6c659636fe25b3ec1259f951a450e5e2c8bbefe47514399f18006ed1e2da
TLSH
T11BB0228BC0032233C00A03B022E08CC838A8CF30C203222282E00E3ACC2C230002B022
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9d980354529006a7a9c1ae162fc746e89fd02c11e72e4b2547722469bb52299b
MD5 65c2a85603c623e6ea0a2acddc58839f
SHA1 33ce88276a3d9c423a9eb639ac5aac113a3ee280
SHA512 c795693f583ea87fc99af0f558881bc5e727de3513116775f24cba55a332152113ddfcc8332412e530b3423f82b3720c977403650908d4a5a7f5bc4ea61d84a7
TLSH
T128B011A8ABB028A2CA0003B803C0C880F8222C2822C2802228B0002A880A28003A208A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 594e34d7c962517783dc07ee480a643141d2f80390d68a3e5d1bcc1f8c3f9fc1
MD5 fcf61862b7b6744bc7e55678d5d8872c
SHA1 50c5a8efbdcb9fd61c5d6692ea513511e62871e8
SHA512 f97ee81f8b6c47ce86896bf3bb53efc75dd442ad740e92a463f96a3e976f84a3f7424adbf76b48c650b6ab3512fe76a1c5764c13ef898cb8358b91b1d43daa94
SSDEEP 3072:YlXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzItqfd7NtZL8cHQRZEQ6SpsF:YGhxNPRW2PYddqmY7U52FSqZ/ZLW3ExF
TLSH
T10B342332BFD61F354C86DE6836431D2E6FF649D8A0B4A781EA296F4F2C43C51745289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 bc31d23bfeb0ac7b67cb6370dcd92abfd416e27d72d3f05f4b49e1202e1a6c95
MD5 50bf51a8db62d0c35f1aaa9a8a87dec0
SHA1 e4f993098de1005a892773b4b3e75bad3d9cf1e4
SHA512 bb0524695c9033731c48286b5e67944464638ff50e93f8a505773bf39600ddacf54f16e0ecc317899f72ff78a5d4be26308ebe7c94bd9ab2a078c0dc70aad146
SSDEEP 3072:2zXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzItqfd7NtZL8cHQRZEQ6SpsF:2khxNPRW2PYddqmY7U52FSqZ/ZLW3ExF
TLSH
T1FF341331BFD21F354C86DE6835433D2A5FF68AD890B8A785F96C7F4F2847850A853898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a37c04fb0e55119c0418441bdb2435f872a8a9a0fdee464bb9568df01fa2ef42
MD5 a75c475d601df601b2cd597d4bda2e39
SHA1 fad9f6bcc1512f24186778236c6cdb692476f92d
SHA512 56d3893d79b01fdd645607faa89ea1ce1137253d1c04e8527d2aaf39ff2e9e1877b940526a3487bce3f4a1a1be4296d4e707eb5cfca7421d641afc538cbecfef
SSDEEP 1536:TsQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:1qfd7NtZL8cHQRZEQ6Spsk
TLSH
T172C30237DBC21F339D96CB60B9530FD697F644A99034D301AA6D77BF6C8389168428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4df26b392031b9399c7e790a48cd79e2548e5c71b31e2a5a381649dfaeb6e752
MD5 e25aa5dbb56b87243b02dfe8199ad730
SHA1 1980c982e4dd53a2df2ed6d77f37a7f89c396625
SHA512 5dbe422f16c76b5af099e4d385d2ca2d9c6533f6e640be01c6565a673f1e34487d112cc00ea92f52af5835bf7be24fd35767f7fc852b4546d76240ba92b110eb
SSDEEP 1536:uhxGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbu:SMqfd7NtZL8cHQRZEQ6SpsJ
TLSH
T10BC30237ABC61E339ED2CB70B9130EDB97F544A99034D301AA7D3BFB6883495658249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dism++10.1.1002.1B.zip.crdownload

Path C:\Users\Admin\Downloads\Dism++10.1.1002.1B.zip.crdownload
Size 3.6MB
SHA256 5bbab96d60704854efd8246a7d9371688b9102261544827fc8884126d70bcb3b
MD5 f5485e418da631b6289e4a51495bca87
SHA1 2ecb84172bf12fec7c9e1f378466db53589660fb
SHA512 61bc53e89c6663c6257297c35615a8ef86604eff2966899699bdfaa69b2c0a721fa28566350d9bee2bb311b9cc0d1823bb796c3cc940f8238871850fd61fa9ab
SSDEEP 98304:vKBqv2ChMWSVDy+Q8YOUoYqeYfsuK0sTILg6ixyeXmziSTPB+u8:SB82KMWqyJfoEY0l0sUAxp2WIPB+u8
TLSH
T1A50633435134E1D0F0DF1EBAB2AB3A5547B24921F064BE22CA5DF833399E756A31912F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.ini

Path C:\Users\Admin\Downloads\Dism++10.1.1002.1B\Config\Config.ini
Size 122B
SHA256 8215e0bbe643ca415aa681b075d11cbbcd00c398efbdb6dc485cb7f5ab79cb4f
MD5 314e32625ddcc133e75e29d5a9c7321d
SHA1 d6a00c841482134548ed8caab2fa9bf7fe025733
SHA512 f683db57da5dae955483e94a4277c4a3e1b97f647de24da91da5b592f6104966b2459a53aced44f737c1ae5282062b2111ed45e79be6cc17774ec7aa6288f6ec
TLSH
T1C4B0927F02CC901BB4708E148BF08034BB0CB8025A2EA57D00EA158C43A1C82E4B20BD
MD5 SHA1 SHA512 TLSH

Submit Download

Dism++.log

Path C:\Users\Admin\Downloads\Dism++10.1.1002.1B\Config\Dism++.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download