69f36bcf47c48dd1a569ccc87c92408255ead81d10719996d871d3c40224879e

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DvnX.exe
Size 1.1MB
Sample261020-2fgp4aay2n
SHA256 69f36bcf47c48dd1a569ccc87c92408255ead81d10719996d871d3c40224879e
MD5 c50181fa05927bb120d8514ceb7beba5
SHA1 9e024cda382b6ca847867efedc7a708bd2c3e2b1
SHA512 c819cc8b3febd91e4e89e2bdb15e0426dc3615b519780296e9cbb6ba6f061a48ad5c8d0cb97b64d0306924c6c9cd2ffe35b4a0ec6de9629121bf63563f14e0e8
SSDEEP 24576:xqN1wXFyyUcvABG/gLLeI3EDkzWNNlyV/5ODYV:xq8Vy7GkdUzY
TLSH
T186355B2C7B990834F0E8FFB47F1AB7433BA5721125FB605F81590E89582A2E496F1D8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 24 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86
PID 3276 set thread context of 4440	3276	Explorer.EXE	86

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\unbuckling\struiarniouc.dat	DvnX.exe
File opened for modification	C:\Program Files (x86)\schemer\iatchoov	DvnX.exe
File opened for modification	C:\Program Files (x86)\sonny\streucsantaoms.dat	DvnX.exe
File opened for modification	C:\Program Files\NTCore\speussoght.txt	Explorer.EXE
File opened for modification	C:\Program Files (x86)\NVIDIA Corporation\illiourt.txt	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2756	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
4440	chrome.exe
4440	chrome.exe
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
4440	chrome.exe
4440	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3276	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4536	DvnX.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3276	4536	DvnX.exe	56
PID 4440 wrote to memory of 4216	4440	chrome.exe	88
PID 4440 wrote to memory of 2756	4440	chrome.exe	89
PID 4440 wrote to memory of 2140	4440	chrome.exe	90
PID 4440 wrote to memory of 2140	4440	chrome.exe	90
PID 4440 wrote to memory of 2372	4440	chrome.exe	91
PID 4440 wrote to memory of 2372	4440	chrome.exe	91
PID 4440 wrote to memory of 2540	4440	chrome.exe	93
PID 4440 wrote to memory of 2540	4440	chrome.exe	93
PID 4440 wrote to memory of 2396	4440	chrome.exe	94
PID 4440 wrote to memory of 2396	4440	chrome.exe	94
PID 4440 wrote to memory of 1020	4440	chrome.exe	95
PID 4440 wrote to memory of 1020	4440	chrome.exe	95
PID 4440 wrote to memory of 1124	4440	chrome.exe	96
PID 4440 wrote to memory of 1124	4440	chrome.exe	96
PID 4440 wrote to memory of 4824	4440	chrome.exe	99
PID 4440 wrote to memory of 4404	4440	chrome.exe	106
PID 4440 wrote to memory of 2440	4440	chrome.exe	107
PID 4440 wrote to memory of 1836	4440	chrome.exe	108
PID 4440 wrote to memory of 5016	4440	chrome.exe	109

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3276
- C:\Users\Admin\AppData\Local\Temp\DvnX.exe
  "C:\Users\Admin\AppData\Local\Temp\DvnX.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8ecac728,0x7ffa8ecac734,0x7ffa8ecac740
    3⤵
    PID:4216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,17059952004769190911,5894480005885502003,524288 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,13166111634208269761,12150812868263278887,262144 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:2140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,11070128677351361680,11315739616974943883,524288 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2544 /prefetch:8
    3⤵
    PID:2372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,15936580302663789533,16028665958276217725,2097152 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,5056229495389127762,16224972948069303248,2097152 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2912 /prefetch:1
    3⤵
    PID:2396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,9801004637607813040,4420161441462427644,2097152 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4384 /prefetch:2
    3⤵
    PID:1020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,11963465224303734930,17895770519013743031,2097152 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,15823596680600828809,12976509581768675672,524288 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,1991552423610695323,5737039522515131022,524288 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,513053017851739998,15245587638101235311,524288 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:2440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,17170814539940446455,17743491736299655578,524288 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:1836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1048,i,6559535511565419457,17449653665650487822,262144 --field-trial-handle=2024,i,5143632550629455756,2215687612606663331,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=844 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

06efcb7e-85c7-4ba7-9c9d-bdad6c16b7e7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\06efcb7e-85c7-4ba7-9c9d-bdad6c16b7e7.tmp
Size 268KB
SHA256 2fce87e87362b321652fe60b1564a07cd18014f1d59b219db6977db27aafbe1b
MD5 2bddf6f4a7b75ffa6b108028f7b7b7db
SHA1 b5e25972c4155f3b5892c7a483d0a6cfaa0414d2
SHA512 32e3a07b9982a5ddc8ba376f31033c25a40b119029a70f11498ae3402bb29ae76b66ecf4c5e1bcbbc885ec79037680d99344b49d9c0e0a802e39efc2bc1b26c3
SSDEEP 6144:u1My3ufSzz8vNfh1i0HX6Nl+hFD+7t56OD9ZfSApprq:Bzo8xBX8lyFSXD9ZfS4s
TLSH
T1ED4423716B67D97F8AF96217D35A42461D609DFC809A560944EB0FCB808FD0903B3F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c25dee8-db4a-4eef-bdc1-b668fd354d55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1c25dee8-db4a-4eef-bdc1-b668fd354d55.tmp
Size 269KB
SHA256 e9c6acc6263db90d97168c4fd9db5502372ef8c70d590527346a71dd903a4b03
MD5 ebde2d57e7612666b52baccf3046d9d9
SHA1 591c9fe377ef0f614f5462249381be818bd992de
SHA512 f60fe31bd6cc1552c1658d9e98381123d41ecf269c34ab3e6ff1d75c022d44c6e04eb6f40375e1bae0962d8882c26ff858037a5f2ca3687d5d339245edf16b9d
SSDEEP 6144:01My3ufSzz8vNfh1i0HX6Nl+hFD+7t56OD9ZfSApprq:Lzo8xBX8lyFSXD9ZfS4s
TLSH
T1144412717B67D9BF8AF66207D35A42465D709DFA809D5A0844AA0FCA808FD0807B3F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b95dc6a-4d14-45d6-89a5-fb82006458a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0b95dc6a-4d14-45d6-89a5-fb82006458a9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

21135bb0-ea1b-4f03-b6be-fdca8601ba69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\21135bb0-ea1b-4f03-b6be-fdca8601ba69.tmp
Size 12KB
SHA256 4d0fc28e21a97f330b3623c4965c609f1eac2048ff34ca9e90d9f4cdebcd4262
MD5 2fda9147957a626307767ec9d42fe14d
SHA1 bde3930a670d0105d9257b2f0fd0eb3d99479f1e
SHA512 df03e33b34926d4d84331f8baabd53ae64bf161d0dc2f52595a9a8ba586920554d2dd217ec2f908034d5667218ec159bcebbbc7a6199c185ce7ab2dc3081bc2f
SSDEEP 192:0R42RxHyZPcv7TpAPRp2V9WHsb+WNnATD0dAecIe8amCVyIsnAUgtaJ:0R42P2IvUX6UwU0Rzav8
TLSH
T1F242843DAE10793B5CDBC22AE9267B53E7F9102170942E84E6FD893C25DB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b5a076f-a2a7-4955-9d3a-ed5fae64862a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5b5a076f-a2a7-4955-9d3a-ed5fae64862a.tmp
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c1d020f-dba2-4b5f-94c6-66a85c2fa7b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4c1d020f-dba2-4b5f-94c6-66a85c2fa7b3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

96f08a36-ad09-4dc5-a81d-0c4a50de71fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\96f08a36-ad09-4dc5-a81d-0c4a50de71fe.tmp
Size 2KB
SHA256 9e8da335e086377ed2b9f2b3be2f5ea3d0adff34295e0ff5ec94dbfb944e49e6
MD5 e8796a52e80e4c0e01f43126677dfac1
SHA1 0f5e28e2dd05e71a525915e921330f1458779c5c
SHA512 2da3e724473062fedfabbad456095c3a8a4ef2923f108c5f6cab84b9a01fc753912f6e60b81d5c6f75a8bc6029e2913b26965ff039a68ab8fe639eb399efe90a
TLSH
T17D51BFF7D7E4867E851156F49A117E2FCD6D0A28531C3C66C8D8AE5B53E2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 dac38efe37ea9477bc4a04050ec6c814b75880d86238839bc82ba1a04de9f0e7
MD5 c77d70de9e02cd1a0cc01a2f6dae438f
SHA1 2a87204e70683f7a73dd569c37850d064709d839
SHA512 71c936d640473777110e497c32f30c82ab255ebcc6ada09a665bce0955f04b6d2a1627b40d1198f6bacafabacd9707f4315780c6e907c736deb30670e48da30c
TLSH
T19CB012C5D4425302C00202F4155464C83194EF15AA05134342F40D018C351A8C03B058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 24861710bcc979cc3cb0d0fec846e924b97779339d494043ea965316578698b2
MD5 c27cce37f67c38b53415047599f8cf16
SHA1 066f7736f84a281f542bd669878714b777603e17
SHA512 e4298f83c2acd4970c1635454c2a0cdb8020234875b26bb4a86fd02ca287010b88d841dc83cbe134207e9e884a9f12e5e420c23dcb600ea20dd43ee77a899af9
TLSH
T178B00255E9036612C1424FF02DA5D5DD7260DF25CA23166692E06AA6DC397B04935560
MD5 SHA1 SHA512 TLSH

Submit Download

e2861cb1-57d4-4fa4-9135-5f6db88776ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e2861cb1-57d4-4fa4-9135-5f6db88776ee.tmp
Size 414B
SHA256 2f53dacf7d5ef879436adddc05d15fa292f0705885e799e8455a1db8a308750a
MD5 b5b9fe73ea0f664f983f5eab38131bb1
SHA1 6e11f997745db8fe38e13d204f23c779e277b33e
SHA512 d7ce7c5cacdfa045541c34140d29f0a3f01907afa53afe38740d3753b7239db841da5b64214215380a192952d058ae9cda7e8c03fa0eaa9936cfa8da702f569f
TLSH
T1E2E02B66C921EC270DFD571D14544641EB5013573B90954F373CD10C8FB563E058A81C
MD5 SHA1 SHA512 TLSH

Submit Download

bf290937-b00b-433c-9b1c-3f42b3e2e9d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bf290937-b00b-433c-9b1c-3f42b3e2e9d9.tmp
Size 268KB
SHA256 b33c7c4624bce86bab72d0b390ff2b0431c2db4be2427d8d274e5137e30c6cd7
MD5 817eacb1bcc6e2c0003f974bb6fb44bb
SHA1 1f73219091666c3e942295efc240457b11c60cc6
SHA512 9dce775cbe84697706d368e15d5944e6e9f60a747d0ede1be5c95dd97ec9893285762aebfe811625202c447f67cc46e041df321c896b749b0d883f08852e039e
SSDEEP 6144:X1My3ufSzz8vNfh1i0HX6Nl+hFD+7t56OD9ZfSApprq:uzo8xBX8lyFSXD9ZfS4s
TLSH
T1914423716B6BD97F8AFA6217D35A42461D609DFC809A560944EB1FCB808FD0903B3F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c49e2b97-b551-4217-bf75-92bb0ab1a96b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c49e2b97-b551-4217-bf75-92bb0ab1a96b.tmp
Size 130KB
SHA256 886e2d2a2c477ae363d3577d1d234bab9f95068ef3ffec20a88cdb5edbd66529
MD5 792aa4f508721d120e8b1e170b90edeb
SHA1 5890b5c91ee535c04216b7463f2ff957eefb51c9
SHA512 b5aa0660eeb44770a3f2e8c8e6d95d172de403f1077e8f3e4eab7f1c62ea2a981a4d89610c4a52303dbd7e286f6ac35169d0bd9a65d6d225996e331b483c7456
SSDEEP 3072:I+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:I+hFD+7t56OD9ZfSApprU
TLSH
T194D31232AA91D8BBC9FD5541B297A300DE766CED41DE2A09444A5F8EE09FC4D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-28-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-23-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-21-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-20-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-19-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-17-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-16-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-15-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-11-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-10-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-30-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-9-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-8-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-22-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-42-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-24-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-26-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-6-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-29-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-83-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-14-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-0-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-3-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-1-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-2-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-4-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-5-0x0000000008940000-0x00000000089DD000-memory.dmp

Download

memory/3276-7-0x0000000008940000-0x00000000089DD000-memory.dmp

Download