Overview
overview
7Static
static
3system 32 d.zip
windows10-2004-x64
1system 32 d.zip
windows11-ltsc_2024-x64
1CustomInstallExec.exe
windows10-2004-x64
1DFDWiz.exe
windows10-2004-x64
3DataExchangeHost.exe
windows10-2004-x64
4DataStoreC...ol.exe
windows10-2004-x64
3Defrag.exe
windows10-2004-x64
7DeviceCensus.exe
windows10-2004-x64
6DeviceCred...nt.exe
windows10-2004-x64
4DeviceEject.exe
windows10-2004-x64
1DeviceEnroller.exe
windows10-2004-x64
1DevicePair...rd.exe
windows10-2004-x64
1DeviceProperties.exe
windows10-2004-x64
1DiskSnapshot.exe
windows10-2004-x64
1Dism.exe
windows10-2004-x64
1ctfmon.exe
windows10-2004-x64
1cttune.exe
windows10-2004-x64
1cttunesvr.exe
windows10-2004-x64
1curl.exe
windows10-2004-x64
1curl.exe
windows11-ltsc_2024-x64
1dasHost.exe
windows10-2004-x64
1dccw.exe
windows10-2004-x64
1dcomcnfg.exe
windows10-2004-x64
5ddodiag.exe
windows10-2004-x64
1deployment...er.exe
windows10-2004-x64
1desktopimgdownldr.exe
windows10-2004-x64
1dfrgui.exe
windows10-2004-x64
1dialer.exe
windows10-2004-x64
1directxdat...er.exe
windows10-2004-x64
1diskpart.exe
windows10-2004-x64
1diskperf.exe
windows10-2004-x64
1diskraid.exe
windows10-2004-x64
4Analysis
- user interaction
yes - max time kernel
299s - max time network
284s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 15:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
system 32 d.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
system 32 d.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
CustomInstallExec.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
DFDWiz.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral5
Sample
DataExchangeHost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral6
Sample
DataStoreCacheDumpTool.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral7
Sample
Defrag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral8
Sample
DeviceCensus.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral9
Sample
DeviceCredentialDeployment.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral10
Sample
DeviceEject.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
DeviceEnroller.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
DevicePairingWizard.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
DeviceProperties.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
DiskSnapshot.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Dism.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
ctfmon.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
cttune.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
cttunesvr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
curl.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
curl.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
dasHost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
dccw.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
dcomcnfg.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral24
Sample
ddodiag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
deploymentcsphelper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
desktopimgdownldr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
dfrgui.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
dialer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
directxdatabaseupdater.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
diskpart.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
diskperf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
diskraid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
300 seconds
General
- Target DFDWiz.exe
- Size 76KB
- Sample261026-s6y8dsxwby
- SHA256 211c577f2902087ad252982e90ac0f00c6712bd536fc99328e3572ae76263805
- MD5 5b264cec1d25fc6db61dd469eefacd52
- SHA1 e1e9da41b8f84a7ff3f1d4cf71bdb7c8fbc8d328
- SHA512 506e6662a02ec7478db92b897167fdba32979150e59fddfe558f6d5f405c1267e58eb296d1f16124e9ed6f560444501611970697b48cb10c750fc6ce82c19a73
- SSDEEP 768:0dPCcSBOoIBiRbxJLn8qy61HRO4uX18WYoLJuZUTopCj1MPWGNUbPGS:0dqJLh1xfkVspNS
- TLSH T12F73E86D92F830A9D4B68334857223659A31B4393F129AEF01F0C5396F16AF09F39F56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2660 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 4628 chrome.exe 4628 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2768 1080 chrome.exe 96 PID 1080 wrote to memory of 5112 1080 chrome.exe 97 PID 1080 wrote to memory of 5112 1080 chrome.exe 97 PID 1080 wrote to memory of 2660 1080 chrome.exe 98 PID 1080 wrote to memory of 1900 1080 chrome.exe 99 PID 1080 wrote to memory of 1900 1080 chrome.exe 99 PID 1080 wrote to memory of 2776 1080 chrome.exe 101 PID 1080 wrote to memory of 2776 1080 chrome.exe 101 PID 1080 wrote to memory of 4224 1080 chrome.exe 102 PID 1080 wrote to memory of 4224 1080 chrome.exe 102 PID 1080 wrote to memory of 3780 1080 chrome.exe 103 PID 1080 wrote to memory of 3780 1080 chrome.exe 103 PID 1080 wrote to memory of 2992 1080 chrome.exe 104 PID 1080 wrote to memory of 2992 1080 chrome.exe 104 PID 1080 wrote to memory of 844 1080 chrome.exe 105 PID 1080 wrote to memory of 3588 1080 chrome.exe 109 PID 1080 wrote to memory of 3604 1080 chrome.exe 110 PID 1080 wrote to memory of 4328 1080 chrome.exe 111 PID 1080 wrote to memory of 4628 1080 chrome.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\DFDWiz.exe"C:\Users\Admin\AppData\Local\Temp\DFDWiz.exe"1⤵PID:4800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9755bc728,0x7ff9755bc734,0x7ff9755bc7402⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,10636084328429327662,14034115544664161737,262144 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,4668495423642397097,606876867180578203,524288 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2328 /prefetch:32⤵
- System Time Discovery
PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2464,i,12272150317673951407,18165132860480664377,524288 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2532 /prefetch:82⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,17661903446277762755,14294954327869874223,2097152 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,14143429299185727042,13061276241936845931,2097152 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:4224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,6078856407490506803,15098832874825409264,2097152 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4528 /prefetch:22⤵PID:3780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4804,i,18257497325526820248,12640198368845247644,2097152 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,17134837921426914273,5965282061652037181,524288 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,15043459582877495999,12777703767109228660,524288 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5912 /prefetch:82⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,10177103316596954234,12273283876877222142,524288 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5924 /prefetch:82⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,11659008720452058001,4499554664874883974,524288 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:82⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1228,i,11610135246207954288,958660547654558996,262144 --field-trial-handle=2080,i,13771649470976424655,3775022246196993064,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5748 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5088
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7f473da9-e501-4736-8fb4-ef4165520ea8.tmp
- Size 270KB
- SHA256 13e2a9e79b0b141a880d5628f5f7623f52d5fc5fd8cc840f0d01dac8efff8c3f
- MD5 e1e2169dd1aecd20a8d25a907e69d4f7
- SHA1 624c909644d52a5d27cea62f44999818fdad93ff
- SHA512 da5d1a3520a6630354b388896c44cfdb6b7225566b44cf9d837c4b2564d53d00d1468a8d101e77a96ea9db73ce59922dcdb9f716906a2c4355d9801e1123b96e
- SSDEEP 6144:XpHhYbFusKYrxbyvK3uWEPt+hFD+7t56OD9ZfSAppr84:5bsKcbyvyItyFSXD9ZfS4+4
- TLSH T14144123A7610BC77C7FA9701E0073705CE7A9AD981C9846881496ECBE19F55E0BF3DA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2b393def-2543-405a-9af5-b85e2386be4a.tmp
- Size 12KB
- SHA256 411beb29a62292dca2f67b9e70b0eabcb87a8b406eac82754cda6bcc6d051a08
- MD5 1918e934d3d12cb5d5c55e559fe9320d
- SHA1 db0b6b39e14a3414a488260db96edf1bf2b5833e
- SHA512 ddc5ce8af8907d4287a2aace265d84c66dfc6be97187ea0909149da777e68dec9f703daaa63da872e2dd15101759aaa4a4f8d374c1ef840671343b27bedddd76
- SSDEEP 192:KRkwhzYsVb6nXv7D0spAPRp239+Hsb+WNnm3I0Get/mrkwaFVyIsnAUgraJ:KRkwhcb/vjUXoUwiI0Zt+r6ze
- TLSH T1C242C52DED14643B9CDBD329F9167B57D7F6102620902E84D6FCCA3C18E79D86227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\404c9405-1f7a-455f-9a40-e5a8e8afe599.tmp
- Size 17KB
- SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
- MD5 f47488285ba0b5fb4fc947c0cd4d65d0
- SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
- SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
- SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
- TLSH T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a1d0653e-d345-4e0d-adcc-79f77b3462e4.tmp
- Size 2KB
- SHA256 4cb6d76d07d61e774ecbd48821e9a0af821a35208fb6cba3f1f2a53c1e4c3bf2
- MD5 50c064651565817b60db281d497044d6
- SHA1 38f3c8a1a8e5231c589750e79f55cd0aa18d0fb8
- SHA512 50df9caca99b1cac4eea8bcfb0fcb714fa03ad43f02ca865f55e696a5efa100faaa73bfc253c41f1c896d206da16001376333e417880d1b6854d49825cde45fd
- TLSH T1C1519EF7C7E4856D851166F4AB116E1FCD3D0A18031C3C6288D4AE4B53F28B2D34134E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a1f7786a-f25b-4778-b896-a8436d4b43fb.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 d5bab4edcebac79cb4af2fbe84c607e5ea25d633920127380fd602e6121fa484
- MD5 234c1e3c9a3e867b65309075568c94ea
- SHA1 abca9d648076b88fd4fe48bfc04d1c49edbb0581
- SHA512 6acd1a2b0225d42cd31f0279e1f3b27e28f1a1f6d80d968999437c7f6d9246516a640efe6cff2d3d762ed1b7432d1b4f853129ff7cc20fff5d4c18806dfe8bf7
- TLSH T199B01216C4413301C04213701255909C73608F34D112138D91F81D21C8311726017108
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 e691820be612f7077ad7048adb19836277fa20093f0fb43a7f999f2d9cda71e5
- MD5 2dffcfcccbc2d0d8fd530278eb77e7ef
- SHA1 2a90e6ad981f6025cac72d8329c01e93970b3db3
- SHA512 5b742eec1b0e102e705a0baf286543221a6c00c570c4c3484558bcd16cae6bdfa3b153ff9ef301526924f7584f3e0b61e341e626f3ce2128a03ed4daab88b445
- TLSH T104B02200C0022202C0032BB022C0EAC8B238EF20C203220382E00A3AEC30F3080220F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c845759d-407a-4780-86ba-796dd046f0cd.tmp
- Size 414B
- SHA256 f3822f4393fd824d6a4f1cbb2d67e68d3fa9c51c276f44b834c5e4596aa26283
- MD5 97e739ceb92cd975121ec48b1ed978af
- SHA1 bfc4ce7142bb56eda7e5f34d3125d0d56eaf98ee
- SHA512 f46ac4e8575ad4a19263789363faa5eefe6fc77ecdb7fce660db53b5083e16f14c2ab5b8b648dbf11d6dc024c66c686fc0397db5efab4f4a550910c2075a4d01
- TLSH T1D1E02BE9C820EC371CFE472964680345E74013872741850F3A3C941D8FB077B458685C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d6d8cff6-2776-4325-b19b-f0dc10512a3a.tmp
- Size 12KB
- SHA256 223772055773332daa30f5725102a993427e67d04e9fb4678ddf022e0a1a4191
- MD5 06bddf5dfc8b61b2361a1900488e56d9
- SHA1 f5915e8b9b3bc3d3cd0815d0d7bcb3cf029b1aee
- SHA512 8c028675b55d6d328dab4c3ece43b104e5de0cd95ae8dc230cc5763913f2b63dd9f3d5021f3225343bdaef6c56194823d3004a38b5bf0f99c29a87404b638717
- SSDEEP 192:KRkwhzYsVb6nLv7D0spAPRp239+Hsb+WNnm3I0wet/mrkwasVyIsnAUgtaJ:KRkwhcbzvjUXoUwiI0Pt+r6I8
- TLSH T17A42C52DED14643B9CDBD32AF9267B57D7F6102520902E84D6FC893C18E79DC622741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dae62bee-7bec-4ffb-8f01-0ef67b6460a7.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cdc20e65-4e1b-40e4-85b6-7093328bf73a.tmp
- Size 130KB
- SHA256 716a91d45efa32cdde4bd74eec526b33019984a0b3bc9933e5fd471d34d9ee5e
- MD5 7e70dca9d7a89d5e6df95ecfcd25d8ef
- SHA1 31a397e068d2784fee9fa353f0d1348c99aae52a
- SHA512 9b8b4ff68c0371039e6501d9a5d04f6767bfdb969693a03023e80770765e7f62b3ab989f9d7803a0e20c67f8d127ea6902c112c1835bef0cb98f12d957abf5f9
- SSDEEP 3072:s+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:s+hFD+7t56OD9ZfSAppry
- TLSH T131D31232AA91D8BBC9BC6541B157A304CE666CED41EE7A09444A5FCEE09FC4C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d6625fc8-1f76-49f1-addd-302b70332729.tmp
- Size 269KB
- SHA256 d578e853b5eae2b76a81069e5ea42354710d7fc9181bfb48c6b2ba9219ce137a
- MD5 dd1dc3d07e1489b13c9598a551beabba
- SHA1 477bcfb4abcc03c041b60d3719d8dc6a7f44def4
- SHA512 5470131011682c9fa14d1228297e6127b8eeba219284806ebc365abfbefec1b0bbafb77fc01f6db8fc27cca56fe2b0d1395edcc2e2dae5533ce8de7128d83a81
- SSDEEP 6144:mHhYbFusKYrxbyvK3uWEPt+hFD+7t56OD9ZfSAppr84:mbsKcbyvyItyFSXD9ZfS4+4
- TLSH T171442326B210BC77C7FA9701E0077B05CE7A9DD981CA80658245AECBE19F95E07F3D62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f00c0e1f-8871-4c54-a1e9-a8b3d6350c40.tmp
- Size 269KB
- SHA256 a61d50728756b03b0621d88f51687688cb454f8f397a243f8a361ed1284dcc7b
- MD5 c76154add5d6a3d715c77af9978a9baf
- SHA1 5bfd713db90f9580320b9bca87116b67e083678b
- SHA512 396ce36cf9bd57a138a66d7ad433c663b53fc68404f7f977d02cf1f811d5c4d477b651ab1e0d22566f2e18b034ac7f6d8722981b0b0819bf8089384b1bb00349
- SSDEEP 6144:ZHhYbFusKYrxbyvK3uWEPt+hFD+7t56OD9ZfSAppr84:ZbsKcbyvyItyFSXD9ZfS4+4
- TLSH T1D8442326B210BC77C7FA9701E0077B05CE7A9DD981CA80658245AECBE19F95E07F3D62
- MD5 SHA1 SHA512 SSDEEP TLSH