Overview
overview
7Static
static
3Dxpserver.zip
windows10-2004-x64
1Dxpserver.zip
windows11-ltsc_2024-x64
1DWWIN.exe
windows10-2004-x64
1DisplaySwitch.exe
windows10-2004-x64
3DmNotifica...er.exe
windows10-2004-x64
1DmOmaCpMo.exe
windows10-2004-x64
1DpiScaling.exe
windows10-2004-x64
7DsmUserTask.exe
windows10-2004-x64
3Dxpserver.exe
windows10-2004-x64
6Eap3Host.exe
windows10-2004-x64
1EaseOfAcce...og.exe
windows10-2004-x64
1dispdiag.exe
windows10-2004-x64
1djoin.exe
windows10-2004-x64
1dllhost.exe
windows10-2004-x64
1dllhst3g.exe
windows10-2004-x64
1dmcertinst.exe
windows10-2004-x64
1dmcfghost.exe
windows10-2004-x64
1dmclient.exe
windows10-2004-x64
1dnscacheugc.exe
windows10-2004-x64
4doskey.exe
windows10-2004-x64
1dpapimig.exe
windows10-2004-x64
1dpnsvr.dll
windows10-2004-x64
1driverquery.exe
windows10-2004-x64
1drvinst.exe
windows10-2004-x64
1dsregcmd.exe
windows10-2004-x64
1dstokenclean.exe
windows10-2004-x64
5dtdump.exe
windows10-2004-x64
1dusmtask.exe
windows10-2004-x64
1dvdplay.exe
windows10-2004-x64
6dwm.exe
windows10-2004-x64
7dxdiag.exe
windows10-2004-x64
7dxgiadaptercache.exe
windows10-2004-x64
1Analysis
- user interaction
yes - max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 16:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dxpserver.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dxpserver.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
DWWIN.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
DisplaySwitch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
DmNotificationBroker.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
DmOmaCpMo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
DpiScaling.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
DsmUserTask.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
Dxpserver.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Eap3Host.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
EaseOfAccessDialog.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
dispdiag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
djoin.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
dllhost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
dllhst3g.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
dmcertinst.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
dmcfghost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
dmclient.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
dnscacheugc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
doskey.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
dpapimig.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
dpnsvr.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
driverquery.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
drvinst.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
dsregcmd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
dstokenclean.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
dtdump.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
dusmtask.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
dvdplay.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral30
Sample
dwm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
dxdiag.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
dxgiadaptercache.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target DsmUserTask.exe
- Size 56KB
- Sample261026-t5mnmsfs41
- SHA256 4ca522be6a9e4a4bc93ff4a6f78045a52dd0fb3fa7f72f9271be6fccd31d6c2d
- MD5 43187f609baebaad3cda845206526536
- SHA1 69adb2f518bc141e2a240c8310d6d6b2d380a758
- SHA512 a50bd76ea236139701fc34451842778dfd9f370bd5759522df1e34fc7471ffe4fe45eb827c191b64833c6241435915500c40146fa8813080c3508010e6cac37e
- SSDEEP 768:ZVSP1dPqPS+SipvEcxvndBxh8N0CRD9LpnbZjK1p:X+b+SipvXBn9hXy/ZjKv
- TLSH T144435B09A3E810E5E479427D8E73550EE172B524A32162EF63A4C17E1FB3FF0A439B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1844 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{7C903252-5DC6-4A9C-A678-BF7AB21E4EE2} chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe Token: SeShutdownPrivilege 3604 chrome.exe Token: SeCreatePagefilePrivilege 3604 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe 3604 chrome.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3604 wrote to memory of 6036 3604 chrome.exe 97 PID 3604 wrote to memory of 392 3604 chrome.exe 98 PID 3604 wrote to memory of 392 3604 chrome.exe 98 PID 3604 wrote to memory of 1844 3604 chrome.exe 99 PID 3604 wrote to memory of 5756 3604 chrome.exe 100 PID 3604 wrote to memory of 5756 3604 chrome.exe 100 PID 3604 wrote to memory of 5000 3604 chrome.exe 102 PID 3604 wrote to memory of 2172 3604 chrome.exe 103 PID 3604 wrote to memory of 5000 3604 chrome.exe 102 PID 3604 wrote to memory of 2172 3604 chrome.exe 103 PID 3604 wrote to memory of 6100 3604 chrome.exe 104 PID 3604 wrote to memory of 6100 3604 chrome.exe 104 PID 3604 wrote to memory of 2732 3604 chrome.exe 106 PID 3604 wrote to memory of 2732 3604 chrome.exe 106 PID 3604 wrote to memory of 4208 3604 chrome.exe 107 PID 3604 wrote to memory of 1736 3604 chrome.exe 111 PID 3604 wrote to memory of 1736 3604 chrome.exe 111 PID 3604 wrote to memory of 5248 3604 chrome.exe 112 PID 3604 wrote to memory of 5248 3604 chrome.exe 112 PID 3604 wrote to memory of 1712 3604 chrome.exe 113 PID 3604 wrote to memory of 1712 3604 chrome.exe 113 PID 3604 wrote to memory of 2848 3604 chrome.exe 114 PID 3604 wrote to memory of 4848 3604 chrome.exe 115 PID 3604 wrote to memory of 5664 3604 chrome.exe 116 PID 3604 wrote to memory of 3568 3604 chrome.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\DsmUserTask.exe"C:\Users\Admin\AppData\Local\Temp\DsmUserTask.exe"1⤵PID:4796
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdcaecc728,0x7ffdcaecc734,0x7ffdcaecc7402⤵PID:6036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,7402935157714200468,827374830329390799,262144 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,12019845884162388913,8670824798426233353,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:32⤵
- System Time Discovery
PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,7811175153007910486,1284789181301352987,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:5756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,8907248147376541810,11853575793720781281,2097152 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3424,i,8505282819813307712,7488171121649397430,2097152 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,17030415568678928797,4363688688380487943,2097152 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3956 /prefetch:22⤵PID:6100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,472166788878519552,11277345129895769270,2097152 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,12778670996944631906,3201288107934891939,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5580 /prefetch:82⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,11168214257297756612,11513592914111784120,2097152 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:12⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3548,i,16313047783710984666,790404668212937861,2097152 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3552 /prefetch:12⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,11478300661671216765,8491935215550871238,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:82⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,6494327840846205250,15323388920054976399,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6044 /prefetch:82⤵
- Modifies registry class
PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,10007014026107198054,16717601424282792874,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6380 /prefetch:82⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,4728023795811624207,11113886350801491955,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6404 /prefetch:82⤵PID:5664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,7300813492385440591,3520669073439461758,524288 --field-trial-handle=1944,i,15955054548814993737,13658963109620461236,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6356 /prefetch:82⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\34e98ed8-7d9e-4fd5-9f5f-b64fbc3301bb.tmp
- Size 270KB
- SHA256 ddf6d6066addb8757ce4dab121c67c41da80b5c82a036d113810f50c32ddebc5
- MD5 228d8a5fca23b7ad8511f7b582e2200e
- SHA1 6466ece2fec9214d2f63b41a98da5fbf44057c8a
- SHA512 fc4a490ea6653eb9721e13f40e658a062942f18775d278ec897a311134f4ded7ad3c8e597538ad78857406a4dc4ea676a7c5400699fa7e9d8fc1e1163922deed
- SSDEEP 6144:iSTRXXyJvsiwTzihIjRikGb+hFD+7t56OD9ZfSAppre:BRXXyJEzTziiBGbyFSXD9ZfS4s
- TLSH T1244412323DA688FFCBEE5902E65B9209DA3094FD85EA5745408A2F8FE05F94D0763D13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4ebc9d31-4815-41dc-81e6-7440284abb9d.tmp
- Size 130KB
- SHA256 080390f2feeabbe77f923143bd6ea4d27062c036d83a457d5841170d8ff5125b
- MD5 a7d3769cfe900305cef2674cea99095a
- SHA1 8277b4eef44801cef4f97a146607b5eb592d6707
- SHA512 8bc28ad0454869b8613166951216fc3c91b9c49fc7a84f4ad43bae74e0a100b62a502005ad625597196aabeac9503659be23b7d88ffb697e3fe5e78c77fd6e31
- SSDEEP 3072:UE+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UE+hFD+7t56OD9ZfSApprB
- TLSH T18DD31232AA91D8BBC9BC6541B157A300CE76ACED45DE3A09444A5FCEE05F94C07B3A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6641d8b4-96f2-4a14-be8e-dec7db41be33.tmp
- Size 270KB
- SHA256 3035eee09a3c6e6b878b054983bd895b801c5c778ac963e86094f913da2e4b63
- MD5 f636d82528411b31101cceb7eeeeff77
- SHA1 e2bce7b6cccd53fd7da9f6ee6461a1709c7e0306
- SHA512 82cca1fe3c541fa51cfcd73ef953df9b56be68f452e137f3c6aca3daa79cb1c2710c871d2045a4f2007adfeef6f4de1aafc716541a9718a39e652f3ffa0903f1
- SSDEEP 6144:hSTRXXyJvsiwTzihIjRikGb+hFD+7t56OD9ZfSAppre:WRXXyJEzTziiBGbyFSXD9ZfS4s
- TLSH T1444412323DA688FFCBEE5902E65B9209DA3054FD85EA5745408A2F8FE05F94D0763D13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\057ff472-3507-495c-8f5c-a2b5b12a5e18.tmp
- Size 12KB
- SHA256 9f8a684d07ca92ba70a7ea535eb1f1d09a66ccfd625b04dc6b083bebba555329
- MD5 27993865a7fedbd14e3fa624383d93d0
- SHA1 065f5a1a5c9ca59603cbfaa065026146c4e3c591
- SHA512 f82bb727fc30976fde869767e904191e6af8e3c8c412e587e2a4317c1c172511927a5138addc592e581d9d7c07683641a66281d4d3dfcf52910c32f21792bed7
- SSDEEP 192:aR3YNzgmaLiv74opAPRp22HB96Hsb+WNnAUdIHlUWQVyIsnAUgtaJ:aR3YNkRurUXHswbdeW8
- TLSH T18942822EBE20793B5CDBC629FA217757D7F5102924952E84E6FC893C24E76CC221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0761a10d-5fdb-4acd-ab1d-a1e492d380cb.tmp
- Size 12KB
- SHA256 c4fd950ce90c4376f23d0ba8252a3785a0603f94c0e906c555141aa00e268f0f
- MD5 e9669b2d0321af3548522f7470f4424f
- SHA1 5fd23a2673893735a2db94621256220d0aba271b
- SHA512 6b7dab6389e571bc378537fbbef2e3a0b43f0f48d29f07a898c53db4e4afa1fe20a428da582560c94dcd2681eae3cff7748b7e191851705fdc7d5e821aa54d47
- SSDEEP 192:aR3YNzgmaLiv7GpAPRp22Hv96Hsb+WNnAUdaHlUWQVyIsnAUgtaJ:aR3YNkRuCUXZswbd0W8
- TLSH T19842932EBD20793B5CDBC629EA217757D7F5102924953E84E6FC893C24E76CC221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\185d6640-7c62-438c-bf5b-f5f6d35355b7.tmp
- Size 414B
- SHA256 b46eda566e407aed964df3bd90c0438e801b7e4f394ae2e2acdff1d1da1cb443
- MD5 b4e2e26a8519fcd7840510f46b117fbf
- SHA1 9c03916d8bbefc6c1fc77cd9fbaa5d060aa9962a
- SHA512 a57d09cb0089ab06d2bbce631a5f65cec55038640769aecaad26296ef8e9a2fc76c35d25c11e59142e172a75d1b6cfbb2594ab1f2459c662350543b60f864b3a
- TLSH T1EBE02BBAC821BC371DFD5B2D50504B8BE64613273640854F7E3D450DCF75A7A02C581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1a0a5ceb-3869-48d4-a8de-07b3d55cb7db.tmp
- Size 13KB
- SHA256 ca8624c456cfbab1fb2806135e53aabccb86593ffeb7a3e776d81ebeecc11b4b
- MD5 fc7697fb2053a60cf8d167386a80280a
- SHA1 2fb6fa4cb4c04a36ac12e11afa3f18355e92ffa3
- SHA512 e25a0b700a900b8a3b2834750778121d316757b472a51804ad053180f0e94187dc9be168aa5d5976098554daeaf553353091fd60c61906de9145dbb5416bb161
- SSDEEP 192:aR3YNzgmaLDv74opAPRp22HB96Hsb+WNnAUeqC2bHlUWBVyIsnAUgraJ:aR3YNkR7rUXHswbO2rle
- TLSH T11E52942EBD20393B5CDBC629FA217757D7F6102524952E84E6FC893C25E76CC221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\29271eff-1ea3-43c7-bde6-d98a739c3095.tmp
- Size 13KB
- SHA256 7733c4536fedc5a1b7ae635a97697985920a53fd2938258becba9ffb0088a6b2
- MD5 3a918ab7e241d6475f7ccf55c3f8e75c
- SHA1 cfee511b7581ab2cbdcbdc483b7e4671d0baee34
- SHA512 5e4fde88b8fa737239b7159f6fa565ecb180198405fda0b2cf180876f155b207e6fd73cb0d2b0bf575f7786726415790860d9e65e82d1b914da1fdf6845074c5
- SSDEEP 192:aR3YNzgmaLZv74opfPRpz2HB96Hsb+WNnAUeqC2AHlUWjVyIsnAUgraJ:aR3YNkR5rhXWswbO2GLe
- TLSH T14B52932EBD20393B5CDBC629FA217B57D7F5102524942E88E6FC893C25E76CC221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 432B
- SHA256 9aa84ce2db98f69b7efd2f0fd5189afce61dc6990244034618b048b6a57ea531
- MD5 442f0491ba99e828c29ae3cce7dc3d14
- SHA1 945c6bcc085af064df065413342b5eabf388ac88
- SHA512 701ddaa1f900aae6f018637896e52a48418fdb82951e974f459a54b5ebf8f6322d08680fe94c5fc73671c969cada8bb697866a9e5ed8651af7a71d73fcc629a9
- TLSH T10EE0D6029A90E860E308AB776033402D12D80A340BE132BEC2C4943B28C3E6E023D2FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 504B
- SHA256 d0b77f3844270aade911cc7b81b98bb19f9354e9d841b85819667b9c6f2e782c
- MD5 d1a3697ba41ef039b2a271870d4a8fb8
- SHA1 c47eb6c15ed4da44dc38792083121fa40c4c5d3c
- SHA512 915ec119eec51e66413c4e0a2555a53a2ac06d4cf78391a36d6f1bcfce3f5da52895bfd08cc528a38206967bcb520681c5a15e317fc6bac8a7453a1f4097f7a8
- TLSH T191F022068650A024E3144F7B6A77C41D05C90A3406D0337EC1E0843328C7D6A073E1F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0fc9f764-4c3c-4427-bb5b-dab9601d6d94.tmp
- Size 5KB
- SHA256 608152f3f80a7ba107f67a195b494869ad750a8731d1878ce75d0668b87a0436
- MD5 1874f19143903c8b3dc2a6e46fde35ac
- SHA1 7efe0af8c34233ecc00c5078576449cfc0d37c64
- SHA512 170afb3195a83c91dba950b55b5df5d74fe9dfe817cc31a044fc242e8c77d3a243a6c08d53ea7c3198802feb355d5cb007fcafe1dc8c0d717ab0f6c13c827057
- SSDEEP 96:D0n/iOLhVNVgaVrtt36dVAVm+TJOsDQ+2pzSZfoAwt7JR:D0n/iOLhVDgadHKdCjYSbEWfto1R
- TLSH T159B19BB7C3E8C62D885156F8A7116F1FCE291A28432D3C27C8E9AE5B93F2471D21574E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8f8c9316-f191-4cec-84c5-e0b6f878528c.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 7d2a9040e07a28ae4b39a6c4f6cf4d5eacfa148487e76548978d421d0cdf15e1
- MD5 c998b6848df976857e33990b6793b5cc
- SHA1 bb2ec0ecb3817b6b6913cbad25b71a157161fbd6
- SHA512 a53121389f08be66d7e8585f85f0a9d60be312c3f7943501f254dfea36ad1132e4ed97845aec5621f22ec5ac94636cd251107ad579ced0002f45b3b9220d13c8
- TLSH T10FB0124580412301C80503B0119490A436609F34E11213C55AE00F1698311A04057139
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 05f29f6cc849d4c14823a6d91d1b879834bfc7b817e660bf04d142f2c9a789b5
- MD5 3cca96fe0177d0d66b240cfc5de3efa7
- SHA1 865152f83d8d2906e04202c0b51b397586077f09
- SHA512 34346a66e0973531a7d0753baf29a55305e26afc146a84c43f596cb0f1382f688d6915f15e14361c0cd8432ae3f0860f6f19d5fe0e61ac3ee567491d49743550
- TLSH T13BB00296C1136616F4C203B02A99E5E87666EF25CA03121793E09B6ADC35661D625560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a3553498-3ab6-45ef-9cc6-6dae0bef2704.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e7c3e0d9-5f70-4d57-a3df-c14ecb277012.tmp
- Size 17KB
- SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
- MD5 ef2f6beced6ed991eb5f4b124485b70c
- SHA1 13ae98461b417e18835295fc68f98db326a5bad0
- SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
- SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
- TLSH T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e84845da-eadb-4f20-bf64-fcde58e0e4f6.tmp
- Size 271KB
- SHA256 7daa1250c6052e1739c2766025b87872d80de6a4813c39faf87380372dd87ee5
- MD5 e664eb4466384d958a49ecb0badadda3
- SHA1 90be58e2067c5fa3dc680d84ebdc0eb9ea8a9c77
- SHA512 be5387eb90c826738620c01672f229f0d8ea69e78d7f55c4851b827e70052fccac51374c82b31489ecbf6136955336f39a83b234f74dd36f60321164f0b7e257
- SSDEEP 6144:i4ETRXXyJvsiwTzihIjRikGb+hFD+7t56OD9ZfSAppre:kRXXyJEzTziiBGbyFSXD9ZfS4s
- TLSH T1E84413323DA688FBCBFF5901A55BA205DD7094FD89EA6B4904852F8FA01FA590723D13
- MD5 SHA1 SHA512 SSDEEP TLSH